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Preface 


For integer factorization and discrete logarithm calculation, P.W.Shor published an 
effective quantum calculation in SIAM Journal on Computing in 1997, which is 
called the Shor algorithm in academic circles. Classical public key cryptosystems 
such as RSA, ECC and so on could not resist the attack of the Shor algorithm, so the 
major security risks of public key cryptosystems are completely exposed to the Shor 
algorithm and quantum computer. 

In the past 20 years, the rise and development of post-quantum cryptography have 
close relation with the lattice cryptosystems. The academic community believes 
that the hard problems on lattice, such as the shortest vector problem (SVP), the 
continuous shortest vector problem (SIVP) and the determination of the shortest 
vector problem (GapSVP) can resist quantum computing effectively, so the public 
key cryptosystems based on the hard problems on lattice become the core theory 
and technology of the post-quantum cryptography. At present, there are six kinds of 
published post-quantum cryptosystems: 


1. Ajtai-Dwork cryptosystem (1997). Ajtai constructed a collision-resistant Hash 
function by the circulant matrix and ideal matrix, and converted the collision point 
into the shortest vector problem on q-ary integer lattice. Ajtai first proposed the 
concept of random lattice (Gauss lattice) in 1996, and established the famous 
reduction principle “from the worst case to the average case’. The security of 
Ajtai-Dwork cryptosystem could be fully proved by this reduction principle. 

2. GGH/HNF cryptosystem (1997). In 1997, Goldereich, Goldwasser and Halevi 
constructed a public key cryptosystem based on the closest vector problem on 
the g-ary integer lattice, which was further improved by Micciancio using the 
Hermite normal basis in 2005. The idea of Micciancio is very simple. Since the 
HNF basis of any lattice can be easily computed from its generated matrix, the 
GGH cryptosystem uses the HNF basis as the public key directly. 

3. NTRU cryptosystem (1998). Number Theory Research Unit (NTRU) is a 
quantum-resistant computing public key cryptosystem developed by J. Hoffstein, 
J. Pipher and J. H. Silverman in Brown University in 1998, which has become 
the most attractive post-quantum cryptosystem due to its simple algorithm, fast 


vi 
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calculation speed and small storage space. In 2009, the National Institute of 
Standards and Technology wrote a survey report: there is no cryptosystem could 
consider both public key encryption and digital signature, and resist the Shor 
algorithm simultaneously. The NTRU encryption algorithm seems to be the most 
likely choice among many lattice-based encryption schemes. The PQCRYPTO 
program (Horizon 2020 ICT-645622) by European Union hopes to develop a new 
European encryption standard based on the NTRU improved by Stehle-Steinfeld. 
MacElience/Niderreiter cryptosystem (1998). Linear codes are the earliest error- 
correcting codes in coding theory. Later, algebraic coding developed based on 
the ideal theory greatly enriched and improved the linear coding theory. Cycle 
code and Goppa code are the most important error-correcting codes in algebraic 
coding. MacElience and Niderreiter constructed a new public key cryptosystem 
by using the asymmetry of encoding algorithm and decoding algorithm of the 
error-correcting code independently, which we call MacElience/Niderreiter cryp- 
tosystem. Since a code (linear code or algebraic code) can be regarded as a lattice 
on a finite field, the security of this cryptosystem is closely related to the closest 
vector problem on the q-ary integer lattice. Recent studies have shown that coding 
theory plays an important role in lattice-based cryptosystems. 

LWE cryptosystem (2005). In 2005, O. Regev of Tel Aviv University in Israel 
proposed the famous LWE cryptosystem based on the LWE distribution. Because 
of this work, Regev won the highest award in the theoretical computer science 
in 2018—the Godel Award. The LWE distribution (Learning With Errors) is 
a random linear system with errors having Gauss distribution. Regev’s cryp- 
tosystem encrypts a single bit of plaintext each time. Since the security of the LWE 
problem has been clearly proved (see Chap. 3 of this book), LWE cryptosystem 
is currently the most active and mainstream research topic. 

Fully homomorphic encryption (FHE). In 1985, R.Rivest, C.Adleman and 
M.Dertouzos first proposed the concept of data bank and the conjecture of fully 
homomorphic encryption. Some individuals and organizations encrypt the orig- 
inal data and store them in the data bank for privacy protection, whichis obviously 
a huge wealth. How to compute these encrypted data effectively? R. Rivest, C. 
Adleman and M. Dertouzos presented the fully homomorphic encryption conjec- 
ture. In 2009, C. Gentry of Stanford University partially solved the RAD conjec- 
ture. Gentry’s work is based on the ideal lattice, that is, an integer lattice which 
has a one-to-one correspondence to the ideal of polynomial ring. But the cryp- 
tosystem of Gentry is a finite-time fully homomorphic encryption, and infinite 
fully homomorphic encryption is still an unsolved public problem. In 2012 and 
2013, the second and third fully homomorphic encryption algorithms based on 
the LWE distribution were proposed one after another. Gentry won the 2022 
Godel Award for his contributions. 


In the book Modern Cryptography, we give a detailed introduction to the basic 


theory of lattice and the first four kinds of lattice-based cryptosystems. The main 
purpose of this book is to discuss the computational complexity theory of lattice 
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cryptosystems, especially Ajtai’s reduction principle, and fill the gap that post- 
quantum cryptography focuses on the encryption and decryption algorithms, and 
the theoretical proof is insufficient. In Chaps. 3, 4 and 6, we introduce the LWE 
distribution, LWE cryptosystem and fully homomorphic encryption in detail. When 
using stochastic analysis tools, there are many ‘ambiguity’ problems in terms of 
definitions and algorithms, such as the ‘~’ notation appeared in a large number of 
papers and books, which is unprecise mathematically. The biggest characteristic of 
this book is to use probability distribution to provide rigorous mathematical defi- 
nitions and proofs for various unclear expressions, making it a rigorous theoretical 
system to facilitate teaching and dissemination in class. Chapters 5 and 7 are based 
on two papers published by the authors in the journal Journal of Information Security 
(see references [63, 64]). These materials can be regarded as some important topics, 
such as the further extension and improvement of cyclic lattices, ideal lattices and 
generalized NTRU cryptosystems. 

This book contains the most cutting-edge and hottest research topics in post- 
quantum cryptography. Reading all the chapters requires a lot of mathematical 
knowledge and a good mathematical foundation. Therefore, this book can be used 
as a textbook for graduate students in mathematics and cryptography, or a reference 
book for researchers in cryptography area. Due to the rush of time, all the mate- 
rials are summarized from domestic and foreign research papers in the last 20 years, 
and shortcomings and mistakes are inevitable. We welcome readers to criticize and 
correct them. 


Zhengzhou, China Zhiyong Zheng 
September 2022 


Contents 


1 Random Lattice Theory ............... 0. ccc eee 1 
LY Fourier Transform sc incur eh case iio exsodese diate deshir 3 

1:2 Discrete Gauss Measūre cisrecoirerirrisik etiket ierra ets 7 

L3 Smootune FardnetT 6 nckes take endscavonseuiaeadsebayie ese 13 

1.4 Some Properties of Discrete Gauss Distribution ................. 25 

2 Reduction Principle of Ajtai .......... uuaa 33 
2:1. Random Lineat Systemi ..cacieraciceieiednei ineiedwedeeenn ds 33 

2a SO Proen 2.259 case ce ee rAr ANEO RIIETE ERA 35 

ok EID PODIE nace eae sees iE AE OENES EEIE ERE AA 39 
2A Reduction Principle gscccastcsoserigatcudat-iadeceuaeceuaeciad 46 

3 Learning with Error «46525 00s.c00sterane nines chew eee ec ddeesas 53 
Sol COMO RUE: sroserirorrr ione a aR rea TOSTE ERER 33 

3.2 SIS and Knapsack Problem on Ring .................0.0000 ee 61 

ao LWE PIG ccs chose tiesdidasadaass heat aea iae hree T2 

34 Prostar the Main Theorem sisisrerirrerika sittre ne rr oera 80 
S41 Prom LWE to DOS sicissicaioririiriaterhttiknitttkiis 81 

3.4.2 From DGS to Hard Problems on Lattice ................. 93 

343 From DIWE TG LWE 3203 sccectngaticonsianbaineesda 97 

4 LWE Public Key Cryptosystem ....................... 000 eee eee 99 
4l LWE Cryptosystem af R6sey ¢ sis bs)csceskdateki eed rO 99 
A The Proai OF SOCUINY serors yt rir EE PEEN dex dveeverdeaned 104 
4.3 Properties of Rounding FUNCHON .. 2.4.5 .06.sss0ecs0eeeeneee ens 108 
4.4 General LWE-Based Cryptosystem ...................0000000. 112 
4.5 Probability of Decryption Error for General Disturbance ......... 115 

5 Cyclic Lattices and Ideal Lattices ....................0. 000 e eee 119 
5.1 Some Basic Properties of Lattice sisrsrieririrsesirsoriirereisi 119 
Din, OCA MINES 504 te eda A Er E E dean EREN 123 


7 


Contents 
Se gels ate? occ autavesadvesacdewedecsiasesarespasesnane 1D 
5.4 Improved Upper Bound for Smoothing Parameter ............... 137 
Fully Homomorphic Encryption .................0 00.00 cece eee es 143 
6.1 Definitions and Examples i.ccsiascascriacietaccetessecsene MA 
6.2 Gadget Matrix and Gadg Thine. AOTER E T EEE ET 148 
6.3 Bounded Fully Homomorphic aatik P E IOS 
6.4 PPARA of Os ntry : 165 
6.5 170 
A Generalization of NTRUencrypt ................ Srteeehareenene es 
Fal <Q e adh ved TT E EEE PTE ET E UATE 
7.2 A Generalization of NTRUencrypt LAER U AVA TIARA TETTE 182 


References ....... EN EEEN T EEN CEST LEES A S T AS EE ~ 189 


Notations 


R[x] 
Z{x] 
Zq\x] 

|x| 

N (xo, r) 
[a] 

{a} 

La] 

f 

A, n) 
E(é) 
Var (&) 
Pr{A} 
U(G) 
P(x) 
poly(n) 
L = L(B) 
L(B)* 
F(B) 
Ai(L) 
p(L) 
ne(L) 
a|x) 

x:y 
AQB 
e(n) r 
g(n) = O(f(n)) 


n dimensional Euclidean space 

Integer points in R” 

Residue class ring mod q 

Complex field 

Polynomial ring of one variable on R 
Polynomial ring of one variable on Z 
Polynomial ring of one variable on Z, 

l norm of vector x 

Sphere with center xo and radius r in R” 

The largest integer no more than real number a 
The fractional part of real number a 

The nearest integer to real number a 

Fourier transform of function f 

Statistical distance of random variable £ and 7 
Expectation of random variable & 

Variance of random variable & 

Probability of random event A 

Uniform distribution on G 


Cumulative distribution of standard normal distribution 


Polynomial function of n 
Lattice L with generated matrix B 


Dual lattice of L with generated matrix (B’)~! 


Basic neighborhood of lattice with generated matrix B 


Minimal distance of lattice L 
Covering radius of lattice L 
Smoothing parameter of lattice L 
Product of real number a and vector x 
Inner product of vector x and y 
Kronecker product of matrix A and B 
Negligible function of n 


g(n) = O(f (n)loglog| f()|) 


Chapter 1 A) 
Random Lattice Theory get 


x] yı 
Let R” be the Euclidean space of dimensionn,x = | : |,y =| : | aretwo vectors 
Xn Yn 
of R”, the inner product of x and y is defined as 
X Y = X1Y1 t+ X22 +--+ Xnyn = X'y. (1.0.1) 


The Euclidean norm |x| of vector x (also called the l} norm) is defined as 
[x] = (a2 + x2 +---422)2 = Jaen. (1.0.2) 


Let B = (bij)nxn E R” be an invertible square matrix of order n, a full-rank 
lattice L in R” is defined as 


L = L(B) = {Bx |x € Z"}. (1.0.3) 


A lattice L is a discrete geometry in R”, in other words, there is a positive constant 
A, = à (L) > 0 and a vector œ € L satisfying œ Æ 0, such that 
la] = min |x| = à (L). (1.0.4) 
xEL,x#0 
A, is called the shortest distance in L, œ is the shortest vector in L. A sphere in n 
dimensional Euclidean space R” with center xo and radius r is defined as 


N (xo, r) = {x € R” | |x — xol < r}, xo € R”. (1.0.5) 
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In particular, N (0, r) represents a sphere with origin as the center of the circle and 
radius r. The discretization of a lattice is equivalent to the fact that the intersection 
of L with any sphere N (xo, r) is a finite set, i.e. 


*(L N N(x0,r)} < œ. (1.0.6) 


Let L = L(B) bealattice, B is the generated matrix of L. Block B by each column 
vector as B = [B), f2, . - - , n], the basic neighborhood F (B) of L is defined as 


F(B) = {9 xib 10 < x; < 1}. (1.0.7) 


i=1 


Clearly the basic neighborhood F (B) is related to the generated matrix B of L, 
which is actually a set of representative elements of the additive quotient group 
R”/L. F*(B) is also a set of representative elements of the quotient group R”/L, 
where 


7 1 1 
F*(B) = iBi| —> Sxi < Zh, 
(B) 92 xiBi| -3Sa <5) 
therefore, F*(B) can also be a basic neighborhood of the lattice L. The following 
property is easy to prove [see Lemma 2.6 in Chap. 7 in Zheng (2022)] 


Vol(F(B)) = |det(B)| = det(L). (1.0.8) 


That is, the volume of the basic neighborhood of L is an invariant and does not 
change with the choice of the generated matrix B. We denote det(L) = |det(B)| as 
the determinant of the lattice L. 

The basic properties of lattice can be found in Chap. 7 of Zheng (2022). The main 
purpose of this chapter is to establish the random theory of lattice. If a lattice L is the 
space of values of a random variable (or random vector), it is called a random lattice. 
Random lattice is a new research topic in lattice theory, and the works of Micciancio 
and Regev (2004), Regev (2004), Micciancio and Regev (2004), Micciancio and 
Regev (2009) are pioneering. In this way, the study of random lattice is no more 
than ten years. For technical reasons, only a special class of random lattices can be 
defined and studied. That is, consider a random variable £ defined in R” from a Gauss 
distribution, and limit the discretization of £ to L so that L becomes a random lattice. 
Itis a special kind of random lattice, which we call the Gauss lattice. The main purpose 
of this chapter is to introduce Gauss lattice, define the smoothing parameter on Gauss 
lattice and calculate the statistical distance based on the smoothing parameter. The 
mathematical technique used in this chapter is high dimensional Fourier transform. 


1.1 Fourier Transform 3 


1.1 Fourier Transform 


A complex function f(x) on R” is a mapping of R” — C, where C is the complex 
field. We define the function space L! (R) and L? (R): 


LiRQ)={f:R">C| [irooiax < oo} (1.1.1) 
R” 


and 
L’ (R)={f:R" >C] [ircorax < oo}. (1.1.2) 
R” 


If f(x), g(x) € L'(R"), define the convolution of f with g as 
frs = | fE- DO A (1.1.3) 
R” 


We have the following properties about convolution. 


Lemma 1.1.1 Suppose f(x), g(x) € L'(R"), then 
(i) f * g(x) = 8 * f(x). 
(ii) f f x g(x)dx = S f(x)dx - f g(x)dx. 

R” R” 


R” 


Proof By the definition of convolution (1.1.3), we have 


8 * f&)= fse — &) f(E)dE = [sore — y)dy = f * g(x). 
R” 


R” 


Property (i) holds. To obtain the second result (ii), we have 


[ fescoar= fof f(x — &)g(&)d& dx 


R” Re R 
z / J Toti J Toi J EdE. 
R" Re R” R” 


The lemma is proved. 


4 1 Random Lattice Theory 


Definition 1.1.1 If f(x) € L'(R"), define the Fourier transform of f (x) as 


f(x) = | potag, x eR". (1.1.4) 
R” 


Note that f > f is an operator of the function space defined on L! (R”), which is 
called the Fourier operator. If f(x) = fi (x1) f2 (x2) +- fa(xXn), then the high dimen- 
sional Fourier operator can be reduced to the product of one dimensional Fourier 
operators, i.e. 


f@) = M AG. (1.1.5) 


The following are some of the most common and fundamental properties of Fourier 
transform. 


Lemma 1.1.2 Suppose f(x) € L'(R"), g(x) € L'(R"), then 

(i) f * g(x) = fœ). 

(ii) a € R” is a given vector, denote T4 f as the coordinate translation function, i.e. 
Taf (x) = f(x + a), Vx € R”. Then we have t, f (x) = e?rixa f(x), 

(iii) Let h(x) = e"4 f (x), thus h(x) = f (x — a). 

(iv) Let 8 £0 be he real number, fs(x) = f (4x), then fs(x) = |8|" f- (x) = 
5|" f (6x). 

(v) Let A be an invertible real matrix of order n, namely A € GL, (R), define f o 
A(x) = f(Ax). Then f o A(x) = IAJ! fo (A75 (x) = IAI! f (A478), where 
AT is the transpose matrix of A. 


Proof By definition, we have 


f* g(x) = i; f * ge dé 


R” 


= [of @ —»eonayre ta. 
R” R” 
Taking variable substitution £ — y = y’, then £ = y + y’, and dẸ = dy’, so we have 


Fega) = / goei dy - f FOT ay = fago, 


R” R” 
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property (i) is proved. Based on the definition of Fourier transform, we have 


TPO) = f FE +ae™tag = f foody 


R” R” 
= e2tixa J fe?" dy = etre P(x). 
R” 
property (ii) gets proved. Similarly, we can obtain (iii). Next, we give the proof of 


(iv). Since 6 Æ 0, and fs(x) = f (Gx), so 


A 1 ; ix 
ha) = J feed = f fOe "dy 


R” R” 
= f FOD sdy = Jêl” f(x). 
R” 
By the condition A € GL, (R), f o A(x) = f (Ax), then 
FoA(x) = f f(Age2"™ Eag, 
R” 
Taking variable substitution, y = A£, then AT! y = £, and dé = |A|~'dy, so 


fo A(x) = J f (ye 24 Y Ady — JA]! / flyje2AY dy 
Rt R” 


= JAJI f(A) Tx) = JAI! f o (ATX). 


Lemma 1.1.2 is proved. 


Finally, we give some examples of the Fourier transform. 


Example 1.1 Letn = 1,a € R, a > 0, define the characteristic function 1j—a,a] (x) 
of the closed interval [—a, a] as 


1, xE [—a, a], 


li-a,a] (x) = to Be ¢ [—a, al. 


Then . 
A sin 271 ax 
li-a, (x) = ————. (1.1.6) 


TX 
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Forn > 1, leta = (aj, a, ...,d,) € R”, the square [—a, a] is defined as 

[—a, a] = [—a), a1] x [—ap, a2] X +++ x [—ay, an]. 
Define the characteristic function 1;~«,q\(x) of the square [—a, a], then 


n n Sin2raixi 
li-a, (x) = IT;_, ————.. (1.1.7) 
UX; 


Proof For the general n, it is clear that 
li-a, (4) = Mi i Lpea;,a;1 (Xi). 
Based on Eq. (1.1.5), we only need to prove Eq. (1.1.6). n = 1, a € R, so 


, l — 1 

li-a,a (x) = 1 lanes de T = — sin 2rax. 

TX 
R —a 


Example 1.2 Let f(x) = e77"? , x € R”, then f(x) € L'(R"), and f(x) = f(x), 
namely f (x) is a fixed point of Fourier operator, which is also called a dual function. 


Proof Clearly, f(x) € L'(R"). To prove the fixed point property of f(x), by defi- 
nition 


f(x) = porn = is meal = ak a 
R” R” R” 
By one dimensional Poisson integral, 


+00 


I eo" dy = 1, (1.1.8) 


—0o 


we have the following high dimensional Poisson integral, 


[a =]; (1.1.9) 


R” 


So we get f(x) = f(x). 
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1.2 Discrete Gauss Measure 


From the property of f(x) = e~** under the Fourier operator introduced in the last 
section, and high dimensional Poisson integral formula (1.1.9), we can generalize 
J (x) as the density function of a random variable from the normal Gauss distribution 
to a general Gauss distribution in R”. We first discuss the Gauss function on R”. 


Definition 1.2.1 Lets > 0 be a given positive real number, c € R” is a vector. The 
Gauss function p;,-(x) centered on c with parameter s is defined as 


psx) =e HPO" x ERY (1.2.1) 


and : 
pŒ) = ps o&), pœ) = ase". (1.2.2) 


From the definition we have 


-rž 


1 
pPs&) = p(—x) =e 
sS 


and 
ps (x) = Ps (x1) tee Ps (Xn). 


It can be obtained from Poisson integral formula (1.1.9) 
f ps(x)dx = f Ps e (x)dx = s”. (1.2.3) 
R” R” 
Lemma 1.2.1 The Fourier transform of Gauss functions ps (x) and ps c(x) are 
Aoa E (1.2.4) 


and l 
Psc (x) = gre Gig): (1.2.5) 


Proof By property (iv) of Lemma 1.1.2 and s > 0, we have 
ps (X) = s” pijs(X) = s” A(sx) = s” p (sx). 


The last equation follows from Example 2 in the previous section, therefore, (1.2.4) 
holds. By the property (ii) of Lemma 1.1.2, we have 


PQ) = Trp (x) = e77: ps) = rer pij (x). 


Lemma 1.2.1 is proved. 
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Lemma 1.2.2 ps (x) is uniformly continuous in R", i.e. for any € > 0, there is 
5 = 5(€), when |x — y| < ô for x € R”, y € R”, we have 


löse) — pscly)| < €. 


Proof By definition, 0 < ps,e(x) < 1, hence ps,-(x) is uniformly bounded in R”, we 
will prove P, (x) is also uniformly bounded in R”. We only prove the case of c = 0. 


Since p,(x) = p;(x|) = +--+ = ps(Xn), without loss of generality, let n = 1, t € R, 
then 5 
, W o ri 
p(t) = ete 2 
When |t| > M, it is clear 
ese 1 
EP 


Hence, when |t| > M, we have 


| ‘wl< 27 z 20 
Pa cs s2|t| © s2M` 


For |t| < M, By the continuity of p, (t) we have p. (t) is bounded. This gives the 
proof that P, e£) is uniformly continuous in R”. Let | Py, e(X)| < Mo, Vx € R”. By 
the differential mean value theorem, we have 


los) — Ps, O = Py E) lx — yl < Molx — yl. 


Let 6 = ig then 
[Psc(X) — Ps cL < €, if |x — y| < ô. 


We finish the proof of the lemma. 


Definition 1.2.2 For s > 0, c € R”, define the continuous Gauss density function 
D; (x) as 


1 
D; (x) =< gn Pac)» Vx € R”. (1.2.6) 


The definition gives that 


1 
f Dewas = Z fe c(x)dx =1. 
s” ; 
R” 


R” 


Thus, a continuous Gauss density function D,.(x) corresponds to a continuous 
random vector of from Gauss distribution in R”, and this correspondence is one-to- 
one. 
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Definition 1.2.3 Suppose f(x) : R” > C is an n-elements function, A C R” is a 
finite or countable set in R”, define f(A) as 


fA =} fo). (1.2.7) 


xeA 


The continuous Gauss density function D, . (x) is also called the continuous Gauss 
measure. In order to implement the transformation from continuous measure to dis- 
crete measure and define random variables on discrete geometry in R”, the following 
lemma is an important theoretical support. 


Lemma 1.2.3 Let L C R” be a full-rank lattice, then 


Ds (L) = > Dil) < o. 


xEL 
Proof From definition, 
1 1 -Ejea 
Diell) = = ) Pc) = Dee 
XEL xeL 


By the property of the exponential function e’, there exists a constant My > 0, when 
|x —c| > Mo, 


oe ee (1.2.8) 
Thus, we can divide the points on the lattice L into two sets. Let 
A; =LN {x € R” | |x — c| < Mo} =LAN(c, Mo). 


and 
Az = LN {x € R” | |x —c| > Mo}. 


From (1.0.6) we have 


> eee < > 1=* A, < oo. 


XEA, XEÁI 
Based on (1.2.8), 


> en alte? < ere <0. (1.2.9) 
CEA? 
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Since Az is a countable set, the right hand side of the above inequality is clearly a 
convergent series. Combining the above two estimations, we have D, -(L) < 00, the 
lemma is proved. 


To give a clearer explanation of (1.2.9), we provide another proof of Lemma 1.2.3. 
First we prove the following lemma. 


Lemma 1.2.4 Let A € R"*” be an invertible square matrix of order n, T = AT A 
is a positive definite real symmetric matrix. Let 5 be the smallest eigenvalue of T, 5* 
is the biggest eigenvalue of T, we have 0 < ô < ô*, and 

VS < |Axlres < V8", (1.2.10) 
where S = {x € R” | |x| = 1} is the unit sphere in R”. 
Proof Since T is a positive definite real symmetric matrix, so all eigenvalues 
61, 62,..., Ôn Of T are positive, and there is an orthogonal matrix P such that 


P'T P = diag{5y, 52, ..., dp}. 


Hence, 
|Ax|? =x?Tx = xT P(P'TP)P' x. 


Since P’T P isa diagonal matrix, we have 


6|P7 x]? < |Ax|? < 8*|P?x/?. 


If x € S, then |PTx| = |x| = 1, so we have V8 < |Ax| < võ. 


By Lemma 1.2.4, and S is a compact set, |Ax| is a continuous function on S, so 
|Ax| can achieve the maximum value on S. This maximum value is defined as || A||, 


||Al] = max{|Ax| | [x] = 1}. (1.2.11) 
We call || A|| for the matrix norm of A, and Lemma 1.2.4 shows that 
V5 < |All < V8*, YA € GL, (R). (1.2.12) 


Another proof of Lemma 1.2.3: Let L = L(B) be any full-rank lattice, B is the 
generated matrix of L. By definition we have 


1 a 2 1 m . 
Ds (L) = > Dn a yee = = 2 eee? 42713) 


xeL xeL xez" 
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From Lemma 1.2.4, 


|B—'x| 
[x] 


< IIB" = [87x] < IBT" [x], Yx € R". 
Let x = By, 5* is the biggest eigenvalue of (B7!)" B~!, we have 


7 1 ims n 
Iyl < IIBT'I] By] > |By| > — yl > lyl/V8*, Vy € R”. (1.2.14) 
B=] 


The property of the exponential function implies that, 


2n 


5 S 
E eits D opo (5 
5 — 02 
xez" ,|Bx—c|>M xeZ",|Bx—c| £0 m"|Bx — c|?” 
Since 
|Bx Gn c|?” = |B(x = B'o)” > |x are, Bo'c/?"/(6*)". 
Denote x = (X1,.-.,4n), Bo'¢ = (u1, ..-, Un), then 
n 
p= Be = Sau > nf ay aD = wa 
i=1 
By (1.2.15), 


2n 1 


2nrs*\n 
sS s” (ê 
m"|Bx — c|?” mn” M (x; — uj)? 


xez” ,|Bx—c|A0 xez" ,|Bx—c|40 


B s” (8*)" 1 5 1 y 1 
mn" eZ (x1 im u)? neZ (x2 7 u2)? x,€Z (Xn =~ Un)? 


every infinite series on the right hand side of the above equation converges, hence, 
Ds,c(L) < œ. 
By Lemma 1.2.3, we define the discrete Gauss density function Dz ,s,e(x) as 


Del) o 


SeS D yD) 


(1.2.16) 


Trivially, we have 


X Drse&)=1. 


xeL 
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So DL,s,c(x) corresponds to a random variable from Gauss distribution defined 
on the lattice L (discrete geometry) with parameters s and c. 


Definition 1.2.4 Let L = L(B) C R” be a lattice with full rank, s > 0 is a given 
positive real number, c € R” is a given vector, define the discrete Gauss measure 
function gzs,-(x) as a function defined on the basic neighborhood F(B) of L, 


2 1 
81,s,0(%) = Dse(X) = | > Psc(e +y), x € F(B). (1.2.17) 


yeL 


By Definition and (1.2.3), it is clear that 


1 1 
J gise(tdx = +F f Pselt + y)dx = + / peo(x)dx = 1. (1.2.18) 
S S 


F(B) yeL F(B) R” 


Thus, the density function g;, -(x) defined on the basic neighborhood F (B) corre- 
sponds to a continuous random variable on F (B), denoted as D; -modL. 


Lemma 1.2.5 The random variable D, ¿modL is actually defined in the additive 
quotient group R" /L. 


Proof F (B) is a set of representative elements of the additive quotient group R” /L, 
and we only prove that for any set of representative elements of R” /L, the discrete 
Gauss function gz.5,-(x) remains constant, then D,. mod L can be regarded as 
a random variable on the additive quotient group R"/L. Actually, if x1, x2 € R”, 
xı = x2 (mod L), we have gzŁ,s,e(x1) = 8L,s,c(X2). To obtain the result, by definition 


n 
yeLl 


_ 1 
8L ae) = Ds) = yn X psc +y). 
Since x; = x2 + yo, where yo € L, so 


1 1 
SL sexi) = gn > Pse +F y) = gn > Ps,c(X2 F Yo + y) 


yeL yeL 


1 = 
= yr > Ps,c (X2 oF y) = Ds ¢(X2) = EL se): 


yeL 


By xı = x2 (mod L), then x; = x2 are the same additive cosets in the quotient 
group R” /L. Thus, the discrete Gauss measure gzs, (x) can be defined on any basic 
neighborhood of L, and the corresponding random variable D, . mod L is actually 
defined on the quotient group R"/L. 
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1.3 Smoothing Parameter 


For a given full-rank lattice L C R”, in the previous section we defined the dis- 
crete Gauss measure gzŁ,s,c(x), and the corresponding continuous random variable 
Ds < mod L on the basic neighborhood F(B) of L. In this section, we discuss an 
important parameter on Gauss lattice—the smoothing parameter. The concept of 
smooth parameters was introduced by Micciancio and Regev in 2007 Micciancio 
and Regev (2004). For a given vector x € R”, we have the following lemma. 


Lemma 1.3.1 For a given lattice L C R", we have 


Jim $ pis) = 1 


xeL 


or equally 


lim D7 pis) = 0. 
xEL\{0} 


Proof By the property of the exponential function, when |x| > Mo (Mo is a positive 
constant) then 
—as?|x/? < 1 


e ; 
` rs? |x|? 


So 


Swe err <= ers — > ae 


xeL xeL |x|<Mo,xeEL |x|>Mo,xeL 


The first part of the equation above only has a finite number of terms, so 


lim 5 ee? — 1, 
SSO 


|x|<Mo,xeEL 


The second part of the above equation is a convergent series, therefore, 


1 1 
lim — — = 0. 
lima 2 pp 


Here, we get the proof. 


By Definition 1.2.3, we have pı/s(L) = X P1/s(x), then p1/s(L) is a monotone 
xeL 
decreasing function of s. When s —> œO, p1/;(L) monotonically decreasing to 1. So 


we give the definition of smoothing parameter. 
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Definition 1.3.1 Let L C R” be a lattice with full rank, L* is the dual lattice of L, 
define the smoothing parameter ne(L) of L: For any € > 0, define 


ne(L) = min{s | s > 0, pr/s(L*) < 1 +6}. (1.3.1) 


Equally, 
ne(L) = min{s | s > 0, pi/s(L*\{0}) < €}. (1.3.2) 


By definition, the smoothing parameter 7, (L) of L is a monotone decreasing function 
of €, namely 
Ne (L) < na (L), if0< e< €. 


Definition 1.3.2 Let A C R” be a finite or countable set, X and Y are two discrete 
random variables on A, the statistical distance between X and Y is defined as 


A(X, Y) = 5 IIPrX = a) — Pr{Y = aj]. (1.3.3) 


acA 


If A is a continuous region in R”, X and Y are continuous random variables on A, 
Tı (x) and T2 (x) are the density functions of X and Y, respectively, then the statistical 
distance between X and Y is defined as 


1 
A(X, Y) = Al IT — Th(x)|dx. (1.3.4) 
A 


It can be proved that for any function f defined on A, we have 
A(f(X), f(Y)) < A(X, Y). 


From (1.2.17) in the last section, Ds, mod L is a continuous random variable 
defined on the basic neighborhood F(B) of the lattice L with the density function 
8L.s.c(x). Let U(F(B)) be a uniform random variable defined on F(B) with the 
density function d(x) = ae The main result of this section is that the statistical 
distance between Ds . mod L and the uniform distribution U (F (B)) can be arbitrar- 
ily small. 


Theorem 1.1 Foranys > 0, givena lattice with full rank L = L(B) C R", L* is the 
dual lattice of L, then the statistical distance between the discrete Gauss distribution 
and the uniform distribution on the basic neighborhood F (B) satisfies 


1 
A(D,,- mod L, U(F(B))) < 5 Prjs(L"\{0)). (1.3.5) 


Particularly, for any € > 0, and any s > ne(L), we have 
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1 
A(Ds,c mod L, U(F(B))) < 5€- (1.3.6) 


To prove Theorem 1.1, we first introduce the following lemma. 


Lemma 1.3.2 Suppose f(x) € L'(R") and satisfies the following two conditions: 
(i) X. | f(x + u)| uniformly converges in any bounded closed region of R” (about 


xeL 
u); 7 
(ii) X. | f (y)| converges. Then 


yeL* 
1 Š 
2 rocno 2 fO), 


where L = L(B) C R” isa full-rank lattice, L* is the dual lattice, det(L) = |det(B)| 
is the determinant of the lattice L. 


Proof We first consider the case of B = I,, here L = Z”, L* = Z”. By condition 
(i), let F (u) be 
Fu)=Y f@œ+u), ueR. 


xez" 


Since F(u) is a periodic function of the lattice Z”, namely F(u + x) = F (u), for 
Vx € Z”, we have the following Fourier expansion 


F(u) = 5 alye"? (1.3.7) 


yez” 


Integrating F (u)e™?i"* for u € [0, 1]”: 


F(uje "du = > a(y)e?™ "Odu = a(x), Vx € Z". 
[0,1] yeZ" io,1]” 
Hence, we have the following Fourier inversion formula: 


a(y) = f Fue du =Y | ferme Oda 
10,17” xeZ"ioip 


p2 / f@e dz = / fle des FO): 


xeZ" sf." R” 
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From the above equation and (1.3.7), 


Fu = >} fen. 


yez" 


Take u = 0, we have 


FO =) > f@) = >> fo, 


xez” yez" 


the lemma is proved for L = Z”. For the general case L = L(B), since L* = 


L((B7!)), then 
Yo f@) = YO (Bx) = YU o BY), 


xeL xez" xez” 


where f o B(x) = f (Bx). Replace f(x) with f o B, then f o B still satisfies the 
conditions of this lemma, so 


Y fo Bx) = Y fo BY). 


xez" yez” 


From the definition of Fourier transform, 


Fo žo) = f f (Bre? dr. 


Take variable substitution t = B~!x, then 


T R —2niy-Bo!x 
FoBO) = aoe | tore reas 
R” 


zmr] fae E a YX dx 


R” 


E )| 


Bo 
= amie yy). 


Above all, 


Sros} foBO)= pan t P= aac 210 


xeL yez" ez" 


We finish the proof of this lemma. 
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The proof of Theorem 1.1 The density function of the continuous random variable 
Ds,- mod L defined on the basic neighborhood F(B) of L is 8Ł,s,:(x), from Eq. 
(1.2.17) and Lemma 1.3.2, we have 


1 1 
Bisel) = =) Pse + y) = | Y | Psex(). 


yeL yeL 


By (1.2.5), the Fourier transform of ps, c—x(y) is 


Ês e- (9) = e7 CE s" pij). 


Combining with Lemma 1.3.2, we obtain 


Sigal = 2 erty —0) py js (y). (1.3.8) 


aa 


The density function of the uniformly distributed random variable U (F (B)) on F (B) 


is rae based on the definition of statistical distance, 


1 1 
A(Dg,. mod L, U(F(B))) = 5 f Steele) = det) 


F(B) 
1 1 2miy-(x—c) 

= laa >. BrP pu Gide 
F(B) yeL*,y#0 


1 , 
< = Vol(F(B))det(L* eee 
5 ol (F (B))det( oe! Pijs O)| 


E ps9) = Tot’ \(0}). 


2 ero 


So (1.3.5) in Theorem 1.1 is proved. From the definition of smoothing parameter 
Ne(L), when s > ne(L), we have 


prjs(L*\{0}) < €. 


Therefore, if s > ne(L), we have 


_ 


A(D,.¢ mod L, U(F(B))) < =e. 


N 


Thus, Theorem 1.1 is proved. 
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Another application of Lemma 1.3.2 is to prove the following inequality. 


Lemma 1.3.3 Let a > 1 be a given positive real number, then 


ye -Z |x|? <a? ven, (1.3.9) 


xeL xeL 


Proof By Definition 1.2.1, the left hand side of the sum in the above inequality can 
be written as | 
pyatx) = et", s = Va. 


Since (s(x) satisfies the conditions of Lemma 1.3.2, we have 


X ps(x) = det(L") $ s(x) = det(L*) $ spijs @). 


xeL xeL* xeL* 


Obviously ,(x) is a monotone increasing function of s, take s = ya > 1, then 


do oga) = aFdet(L*) YT pa (x) <atde(L*) $ p(x) 


xeL xeL* xeL* 


=a? X oQ) = — gi yee, 


xeL xeL 


We complete the proof of Lemma 1.3.3. 


Let N = N (0, 1) be the unit sphere in R”, namely 
N = {x e R” | |x| < 1}. 


Lemma 1.3.4 Suppose L C R” is a lattice with full rank, c > a is a positive real 
number, C = cV2me- e-*, v € R”, then 


p(L\cVnN) < C"p(L), and p((L + v)\cVnN) < 2C"p(L). 


That is, 


y ent? ae eet, (1.3.10) 


xeL,xd¢c./nN xeL 


> e77 xl? < 2C” 5 eT, 


xeL+v,xgceynN xeL 
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Proof We will prove the first inequality, ler t be a positive real number, 0 < t < 1, 


then 
dremel = Seto. ozrl? 


xeL xeL 


Aiid Ceja 
> X e70 t)|x| ve |x| 


xeL,|x|/?>c2n 


> et-nern > ent 


xeEL,|x|?2>c2n 


In Lemma 1.3.3, take a = L, thena > 1, we get 


= 2 E. 7” 2 
X e mt|x| <t 5 X e |x| . 


xeL xeL 


Hence, 


= 2 er ee _ 2 2 n -|2 
X e |x| <e m(1—t)c D e mt|x| < e m(1—t)c ng- X e 1 |x| S 


xEL, |x|? >c?n xeL xeL 


It implies that 
1 2an 
p(L\cVnN) < (t 3e") o(L). 


Let t = si then 


wc? 


p(L\cVnN) < (c- V2re - e72)" p(L), 


The second inequality can be proved in the same way. Lemma 1.3.4 holds. 


Based on the above inequality, we can give an upper bound estimation of the 
smoothing parameter on lattice, which is a very important result about the smoothing 
parameter. 


Theorem 1.2 For any n dimensional full-rank lattice L C R”, we have 


m (L) < vVn/A(L*). (1.3.11) 


where à (L*) is the minimal distance of the dual lattice L* (see (1.0.4)). 


Proof Take c = 1 in Lemma 1.3.4, we first prove 


(1.3.12) 
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If we take the logarithm of both sides, then 
log(3277) + 1 < 27. 
Since we have the following inequality, 
log(327) + 1 < log128 + 1 < 27. 
So (1.3.12) holds. By Lemma 1.3.4, we have 
p(L*\VnN) < C"p(L*) = C” (o(L*\WnN) + p(L* A VnN)). 


From the both sides, we get 


n 


SE n./nN). 


p(L*\/nN) < i 


Ifs > y/n/àı(L*), for all x € L*\{0}, 
|sx| > s -ài (L*) > vn => sL* N VnN = {0}. 
Hence, 
pijs(L*) = p(sL*) = 1 + p(sL*\VnN) 


n 


C 
<l+ io n./nN) 


Take e = 2~", then 
nz- (L) < JSn/Ai (L*). 


Theorem 1.2 is obtained. 


According to the proof of Theorem 1.2, we can further improve the upper bound 
estimation of the smoothing parameter. 


Corollary 1.3.1 Let 


1 log2z 1 
r= + + log(1 +2”). (< 0.82) (1.3.13) 
20 20 ni 


1.3 Smoothing Parameter 
Then for any full-rank lattice L C R”, we obtain 


m=(L) < r/n/A(L*). 


. 1 

Proof Take c > r in Lemma 1.3.4, then c > Te and 
ae C” 

C=c:V2me-e™ > <a 


1 
< —. 
2n 


By Lemma 1.3.4, for any full-rank lattice L C R”, we have 


n 


p(L*\cv/nN) < i 


Ifs > c./n/a,(L*), for any x € L*\{0}, 
|sx| > sài (L*) > cyn. 


Hence, 
sL* NcvnN = {0}. 


Therefore, 
prjs(L*) = p(s L*) = 1 + p(L*\cvnN) < 1 + 
Finally we have (let c > r) 


Ma- (L) < rJ/n/d4(L*). 


Corollary 1.3.1 is proved. 


C 
en PL" Nc /nN). 


n 


C 


12C 


21 


(1.3.14) 


(1.3.15) 


1 
Qn . 


Corollary 1.3.2 For any n dimensional full-rank lattice L C R”, we have 


4 
m= (L) < ZEVAM). 


Proof Take c = 3 in Lemma 1.3.4, then c > Te and 
ao C” 
CSc Zmene T aT 


1 
< —. 
2n 


Lemma 1.3.4 implies that for any full-rank lattice L C R”, we have 


n 


piL\eVAN) < 


p(L* NcJ/nN). 


(1.3.16) 
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Ifs > c/n/a,(L*), for any x € L*\{0}, 
|sx| > sd, (L*) > cyn. 


Hence, 
sL* NV cJ/nN = {0}. 


We get 


Ce 1 
which implies that 


4 
m= (L) < ZVA). 


Corollary 1.3.2 is proved. 


In the following, we give another classical upper bound estimation for the smooth- 
ing parameter. For any n dimensional full-rank lattice L C R”, we have introduced 
the definition of minimal distance 4; (L) on lattice, which can actually be generalized 
to the general case. For 1 <i <n, 

Ai(L) = min{r | dim(Z N rN(0, 1)) > i}. (1.3.17) 
A; (L) is also called the i-th continuous minimal distance of lattice L. To give an 


upper bound estimation of the smoothing parameter, we first prove the following 
lemma. 


Lemma 1.3.5 For any n dimensional full-rank lattice L, s > 0, c € R”, then 


Ps,c(L) <S ps(L). (1.3.18) 


Proof According to Lemma 1.3.2, we have 
Ps.c(L) = det(L*) 6s,-(L*) 


= det(L*) $. ôO) 


yeL* 


= det(L*) ) ep) 


yeL* 


< det(L*) $` A.(y) = ps(L), 


yeL* 
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where we have used , ¢(y) = e~27'° A, (y), the lemma gets proved. 


Theorem 1.3 For any n dimensional full-rank lattice L, € > 0, we have 


ne(L) S y men +119), i), (1.3.19) 


where àn(L) is the N-th continuous minimal distance of the lattice L defined by 


(1.3.17). 
_ 2o TEE 


Proof Let 

we need to prove p/s (L*\{0}) < €. From the definition of à, (L), there are n linearly 
independent vectors v1, v2, ..., Vn in L satisfying |v;| < àn (L), and for any positive 
integer k > 1, we have v;/k ¢ L, 1 <i < n. The main idea of the proof is to take a 
segregation of L*, for any integer j, let 


Sj ={x eL" xu =j} cI, 


for any y € L*\{0}, there is v; that satisfies y - v; # 0 (otherwise we have y = 0), 
which implies y ¢ S; o, i.e. y € L*\ S; o, so we have 


L*\{0} = U? (L*\ So). (1.3.20) 
To estimate p1/s (L*\S;,0), we need some preparations. Let u; = v;/|v; 7, then |u;| = 
1/|uj| > 1/An(L). Vj € Z, Vx € Si j, 
“2 2 
: ; ; ; J J 
(x — jui) ju; = jx- u; — Puy ui = — - — = 
v;| |v; | 
Therefore, 
|x|? = |x — juil? + (juil. 
So ao 
Pi/s (Si, j) = 5 eon 
xe Si, j 
— ects lju? > ents lx- juil? 
xES; 3 
= e714!” oiy (S;,; — jui). (1.3.21) 


Since the inner product of any vector in $; ; — ju; with v; is 0, then S; ; — ju; 
is actually a translation of S; o, namely there is a vector w satisfying S$; j — ju; = 


24 1 Random Lattice Theory 


Sio — w. In fact, for any x; € Si j, Xo € Sio, W = xo — x; + ju; satisfies the equality 
Si,j — jui = Sio — w. By Lemma 1.3.5, we have 


Pi/s(Si,j — jui) = Pis (Sio — W) = P1/s,w(Si,0) S P1/s(Si,0). (1.3.22) 
Combine (1.3.21) with (1.3.22), 
Piss (Si j) S en 71H? oy 16 (S;.0) < eH S/n D o (Sio). 


When x > 1, it follows that 


Ja “oy = -a 


j#0 j>0 


Next, we will estimate p1,,(L*\Sj,0), 


Piys(L*\ Sio) = 5 P1ys (Sij) 


770 
= 232 
< Xe TEMENI pagel 8:6) 
770 
< ema LI [Piss (Sio) 


2 
= zemo g EÀ = P1/s(L*\S;,0)). 


So we get 


Prys(L*). 


2 
* 
pys(L\Si0) S Sop] 


From (1.3.20), 


n 


prjs(L*\{0}) < > prjs(L*\Si,0) < 


i=1 


2n L* 
emay q 1 Push). 


Together with p1/s(L*) = 1 + piys(L*\{0}), we have 


2n 2n 
mD +1—2n ~ ekC/aD? — In 


pijs(L*\(0}) < é: 
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In the last equality, we have used that 


a nos YO) 5, 


Based on the definition of the smoothing parameter, 


ne(L) < y ment y 


Theorem 1.3 is proved. 


At the end of this section, we present an inequality for the minimal distance on 
lattice, which will be used in the next chapter when we prove that the LWE problem 
is polynomial equivalent with the hard problems on lattice. 


Lemma 1.3.6 For any n dimensional lattice L, € > 0, we have 


Ini/e 1 In 1/e A, (LZ) 
ne(L) >, / z Mey 7 V = a (1.3.23) 


Proof Let v € L* and |v| = A, (L*), s = n-(L), from the definition of smoothing 
parameter, we have 


2452 * 
e= P1js(L*\{0}) > Pijs (V) — ermal’) 


[Inl/e 1 
SS . 
m ài (L*) 


That is, the first inequality in this lemma holds. For the second inequality, Theorem 
2.1 in Banaszczyk (1993) implies that 


Hence, 


1 < à (L*)àn(L) <S n, (1.3.24) 


so we immediately get the second inequality. The lemma holds. 


1.4 Some Properties of Discrete Gauss Distribution 


In this section we introduce some properties about the discrete Gauss distribution. 
First we give the definition of the expectation of discrete Gauss distribution. 
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Definition 1.4.1 Let m, n be two positive integers, L C R” be ann dimensional full- 
rank lattice,c € R”,s > 0,€ is arandom variable from the discrete Gauss distribution 
Dt sc» and f : R” > R” is a given function, we denote 


ElE]= J. xDr,s,c(x) (1.4.1) 


€é=xeL 


as the expectation of £, and denote 


ELfFEI= DY) F@)Dis,c(x) (1.4.2) 


€é=xeL 
as the expectation of f (E). 


Lemma 1.4.1 For any n dimensional full-rank lattice, L C R”, c, u € R”, |u| = 1, 
O0<e <1,s > 2n.(L), £ is a random variable from the discrete Gauss distribution 


DL s.c then we have 
ES 


IELE = 0) -ull < F7 
=E 


(1.4.3) 


and 
ES 


2 
IEKE — c) - u)}’] — =| < (1.4.4) 


l= 


Proof Let L' = L/s = {* | x € L}, c’ = c/s, §' is a random variable from the dis- 
crete Gauss distribution Dr «~, for any x € L’, we have 


pe (x) = Ps,c(SX) 
Pe (L’) Ps,c(L) 


PE =x} = = Pr{é=sx}. 


That is, Pr{ = x} = Pr{é’ = x}, Vx € L’, therefore, 


E(€ —c)-u]= sË = c") - u] = SER — c’) - u], 


the inequality (1.4.3) is equivalent to 


€ 


JELE — c’) - ull < (1.4.5) 


l-e 
Similarly, the inequality (1.4.4) is equivalent to 


€ 


1 
[ELKE — c") -u)?] — mE (1.4.6) 


l-e 


So we only need to prove the two inequalities for s = 1. Denote £ as a random variable 
from the discrete Gauss distribution Dz ., the condition s > 27,(L) in Lemma 1.4.1 
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becomes ne(L) < 5. We prove that the two inequalities (1.4.5) and (1.4.6) hold if 
u = (1,0,..., 0) firstly. For any positive integer j, let 


gj(x) = (x1 — c1) pe(x), 
where x = (x1, X2, ana Xn), c= (c1, C2, Ree, Cn). Let £ = (GE &, a En), then 


gj(L) 


EKG —¢)-u)/] = E — 1/1] = Ly 


Based on Lemma 1.3.2, 


_ gi(L) _ IAEE _ 8)(L*) 
pL) IAEA AE 


EKE —c)-u)/] (1.4.7) 


In order to estimate 6.(L*), from Lemma 1.2.1 we get 6¢(x) = e277 n(x), thus, 
[Pc(x)| = p(x), note that ne(L) < 5 < 1, 


A= $ Ael- YP [ae =1- p(L"\(0)) > e 
xeL*\{0} xeL*\{0} 
(1.4.8) 
To estimate g;(L*), assume pu! ; (x) is the j order partial derivative of p(x) about 
the first variable x), i.e. 


pP Œ) = ieo. 
If j = 1, 2, it is easy to get 
pP (x) = -2r (xı — c1)pe (x). 
p(x) = 4r? a — c1)? — 2r) p- (x). 


It follows that 


1 oD 
81x) = = 77 Pc). 
JT 


ga) = p(x) + pee) 
42" € yy on 
Since p” (x) = (27ix1)/ ĝe(x), we have 
&1(x) = —ix16,(). 


er aa 
(x) = c= — X7)Pc(x). 
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; ‘ : lx? 
According to the inequality |xı| < y |x|? < e7 and ne(L) < 5, 


j 


lxl2 


Igi(L*)| < 5 xal lÊ] = = Ixile (x) < > ere tl 


xeL* xeL*\{0} xeEL*\{0} 
< OF = m(L*\(0)) <e. (1.4.9) 
xeL*\{0} 


Combining (1.4.7), (1.4.8) and (1.4.9) together, 


A&E e 


ELE — 0) wil eT 


For a general unit vector u € R”, there exists an orthogonal matrix M € R”*” such 
that Mu = (1,0,...,0). Denote 7 as a random variable from the discrete Gauss 
distribution Dy-1,, y-'c, for any x € L, 


<1). =1 (2 
Pu-'e(M—!x) e771M x—M` c| 


Pr{n= M~'x} = I = I 
Pm-c(M7 L) Pm-c(M7 L) 


—m\|x—c|? 
e A 


= Pr{é =x} = Pr{M'E = M`'x}, 


which implies that the distributions of n and M~'é are the same, hence, 


€ 


LELE — c) - ull = |EIM'(E — c) - Mull = [EL — Me) - Mul] < ——. 


Above all the inequality (1.4.3) holds, and inequality (1.4.4) could be proved in the 
same way. We complete the proof of Lemma 1.4.1. 


Lemma 1.4.2 For any n dimensional full-rank lattice L C R”, c € R",0 <€< 1, 
S > 2ne(L), € is a random variable from the discrete Gauss distribution Dz sc, then 
we have 


€ 
IE[E — c]? < (sn, (1.4.10) 
— e€ 
and j 
Etlé — cl] < (— + É s?n. (1.4.11) 
2m l—e 
Proof Letu, u2,...,U, be then unit column vectors ofn x n matrix 1,, by Lemma 
1.4.1, 


JEI — cll? = P ETE - ©) wil)? < GY, 


i=l 
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yen. 


n 1 
E[l — c] = ) EKE — 0) ui)’] < (z> + 


i=1 


J= 


Lemma 1.4.2 holds. 


Lemma 1.4.3 For any n dimensional full-rank lattice L C R”, v € R",0 <€< 1, 
S > ne(L), & is a random variable from the discrete Gauss distribution DL s x, then 


we have fat 
Pr{|— — v| > svn} < r~. (1.4.12) 
=g 


Proof From the proof of Lemma 1.4.1, here we only need to prove for the case 
s = 1. Since 


Prig- >vm= 5 a 


xeEL,|x—-v|>/n 


2 5 2) 2G) 


xD „(L 
xEL,|x—v|>yn Pol ) Pol ) 


3 


take c = 1 in Lemma 1.3.4 and get 


p((L — v)\VaN) < 2" p(L). 


That is, 
p(L) 


Pa (L) 


Based on Lemma 1.3.2, Lemma 1.2.1 and n.(L) < 1, 


Pr{jė — v| > vn} <2" (1.4.13) 


pr(L) = [P (L)| = |det(L*) Â (L) = |det(L") $ ee" o) 


xeL* 


> ldea- $O eow) = Idet(L*)|(1-— > eE) 


xeL*\{0} xeL*\{0} 
= |det(L*)|(1 — p(L*\{0})) > |det(L*)|(1 — €). (1.4.14) 


Similarly, 
p(L) = |p(L)| = |det(L*) p(L")| 


= |det(L*) D7 pay] = daa D7 play) 


xeL* xeEL*\{O} 


= |det(L*)|(1 + p(L*\{0})) < |det(L*)|(1 + ©). (1.4.15) 
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Combining (1.4.13), (1.4.14) and (1.4.15) together, it follows that 


Pr{lé—v| > Va} < < (tio. 


This lemma holds. 


For x € R” anda set A C R”, we define the distance from x to A as dist(x, A) = 
min |x — y|. 
i ee 


Lemma 1.4.4 For any n dimensional full-rank lattice L C R”, c, v € R",0 < € < 
1, s > ne(L), & is a random variable from the discrete Gauss distribution D; sc, 
dist(v, L*) > ce then 

l+e 


|E[e?™ E] < i a (1.4.16) 
—eE 


Proof From the proof of Lemma 1.4.1, we only need to prove for the case s = 1. 
Let 


2mix-v 


g(x) =e D(x). 


By Lemma 1.3.2, 


Eje2t#") = g(L) L det(L*)g(L*) _ &(L*) 
pc(L) — det(L*)p,(L*) — pe(L*)” 


We have proved that |6.(L*)| > 1 — € in Lemma 1.4.1, based on (iii) of Lemma 
1.1.2 and Lemma 1.2.1, 


—2mi(x—v)-c 
i 


8) = Âx — v) = p(x — v)e 
therefore, 


BL = 1D eG- ne me S p(x — v) = p(L* — v). 


xeL* xeL* 
Since dist(v, L*) > ./n, we know 
p(L* — v) = p((L* — v)\V/nN). 
Take c = 1 in Lemma 1.3.4 and get 
p((L* — v)\VnN) < 2-"p(L*) = 2” (1 + p(L*\f0)) < 2” +). 
Above all, 


pi * 
&(L*) 2 LP en 


E 2nié-v = < 
Ele" = |S al < 
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We complete the proof of Lemma 1.4.4. 


Lemma 1.4.5 For any n dimensional full-rank lattice L C R”, w,c,v € R”, 0 < 
e€ <1,s > ne(L), € isa random variable from the discrete Gauss distribution DL sc, 


dist(v, L*) > “, then 


l+e 


|E[cos(27(€ + w)-v)]| < i ae, (1.4.17) 
—e 
Proof By Lemma 1.4.4 we have 
2ril+w)v Qmié-v Ie -n 
|E[cos(2x (E + w)-v)]| < |Ele l| = [Elet] < e 


Lemma 1.4.5 holds. 


Finally, we give a lemma which will be used in the next chapter. 


Lemma 1.4.6 Let vi, v2, ..., Um be m independent random variables on R” such 
that E[|v;|?] < land |E[v;]|? < efori = 1,2, ..., m. Then foranyz = (Z1, Z2,.--; 
Zm)! E€ R”, 

EĻ XO zivi] < 0+ me)lz}?. (1.4.18) 


Proof By Cauchy inequality we get X74; |z:| < ./m|z|, so 


Et) Y zivil l= $O zz Elv vj] = Do PE [P+ Do zz Elv] - Elvj. 
i=l i,j i 


i#j 
(1.4.19) 
The first term of the right hand side in (1.4.19) has the estimation 


Lael [lv]? SAn = l|zl. 


The second term of the right hand side in (1.4.19) has the estimation 


1 
deez Elve] - Elv] <} lzillz;l 50E? + EWID 
ij iAj 


2 2 
< Yo elzillzsl < QQ teil)? < mela’. 
i 


izj 
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From (1.4.19) it follows that 


El] $ zivi] < d+ me)lzl?. 


i=l 


This lemma holds. 
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Chapter 2 A) 
Reduction Principle of Ajtai chenet 


In 1996, the famous scholar Ajtai proposed the reduction principle from the worst 
case to the average case at the 28th Summer Symposium of the American Computer 
Society (ACM), named the Ajtai reduction principle [see Ajtai (1996), Ajtai (1999) 
and Ajtai and Dwork (1997)]. Subsequently, Ajtai and Dwork presented the first 
lattice-based cryptosystem, which is called the Ajtai-Dwork cryptosystem in the 
academic circles. The proof of this cryptosystem resisting Shor’s quantum computing 
is to apply Ajtai reduction principle to transform searching for collision points of 
the Hash function into the SIS problem, and Ajtai reduction principle proves that the 
difficulty of solving the SIS problem is polynomially equivalent to the shortest vector 
problem on lattice. The main purpose of this chapter is to prove the Ajtai reduction 
principle. 


2.1 Random Linear System 


Let A € Zy” be ann x m matrix on Z,, if each element of A is a random variable 
on Z4, and the n x m random variables are independent and identically distributed, 
then A is called a random matrix on Z,. We give the definition of random linear 
system 


y = Ax +z (mod q), x Za y Zi z Li (2.1.1) 


where x, y, z are random variables on Zy and Z/, respectively. This random lin- 
ear system plays an important role in modern cryptography. We prove some basic 
properties in this section. 


Lemma 2.1.1 Let A € Zy” be an invertible square matrix of order n, y = Ax (mod 
q), then y is uniformly at random on Z} if and only if x is uniformly distributed. 
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Proof If x is uniformly distributed on Z%, then for any xo € Z}, we have 


1 


Pr{x = xo} = —. 
q” 


Since there is only one yo € Za => Axo = yo (mod q), therefore, 


1 
Pr{y = yo} = Pr{x = xo} = g 


Because A is an invertible matrix, there is a one-to-one correspondence between yo 
and xo. In other words, when xo traverses all the vectors in Zp yo also traverses all 
the vectors in Z}, which means y is also uniformly at random on Z%. On the other 
hand, if y is uniformly distributed on Z7, so is x on Z% by x = A~'y (mod q). 


Remark 2.1.1 In fact, for the above linear system, x and y are random variables with 
the same distribution when A is an invertible square matrix. However, this property 
doesn’t hold if A is not a square matrix. 


Let a € R be a real number, [a] be the greatest integer no more than a, i.e. [a] is 
the only integer satisfying the following inequality, 


[la] <a < [a] +1. 
If x € R” is ann dimensional vector, x = (x1, X2,..., Xn), we define [x] as follows 
[x] = (41), [x2], [Xn € Z”. 
[x] is called the integer vector of x. We say x is a random vector, which means each 


element x; is a random variable, and the n random variables are mutually indepen- 
dent. 


Lemma 2.1.2 /fx € [0, 1)” is a continuous random variable uniformly distributed 
on the unit cube, then [qx] is a discrete random variable uniformly on Z}. 


Proof Since all the components of x are independent, we only prove for n = 1. 
If a € [0, 1) is a continuous random variable uniformly distributed, then for any 
i =0,1,...,q — 1, we have 


j 1 
Pr{lqa] =i} = Prļi < qa <i+1}= Pr{+ <a < —. 
q q q 


This indicates [qa] is a discrete random variable uniformly distributed on Z4. 
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Lemma 2.1.3 Let L = L(B) be an dimensional full-rank lattice, F (B) is the basic 


neighbourhood of L. If x is a random variable uniformly distributed on F(B), then 
[q B7!x] is a discrete random variable uniformly on Zy 


Proof Va € Z4» we have 


B(a +1) 
< — 
q 


1 Ba 
Pr{[qB x] = a} = Pr{— <x }. 
q 


Since the volume of basic neighbourhood F (B) is det(L) = |det(B)|, the probability 
1 


density function of x is D’ thus, 
Ba+1) atl 
q q 
B B 1 1 det(B 1 
Pr{ See <d f dy = [eti lipa 
q q det(L) det(L) q” 


Ba 
q 


We set y = Bu in the above equality, and get 


Pr{{qB°'x] =a}s= L 
q 


So [qB~'x] is uniformly distributed on Zi: 


2.2 SIS Problem 


The SIS problem plays a very important role in modern lattice cryptography, which 
is to find the shortest nonzero integer solution in a class of random linear systems. 


Definition 2.2.1 Letn, m, q be positive integers, m > n, A € Z% ” is a uniformly 
distributed random matrix on Z,, 8 € R, 0 < B < q. The SIS problem is to find the 
shortest nonzero integer vector z € Z” such that 


Az = 0 (mod q), and z £0, |z| < £. (2.2.1) 


We call the above SIS problem with parameters n, m, q, A, B as SISy,¢,6,m, and A is 
called as the coefficient matrix of SIS problem. 


Remark 2.2.1 Ifm < n, since the number of variables is less than equations, (2.2.1) 
is not guaranteed to have a nonzero solution, so we suppose that m > n. If B > q, let 
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q 
0 

z= | . | € Z”, we have Az = 0 (mod q), and |z| = q < £. This solution is trivial 
0 

so that we always assume that 6 < q in Definition 2.2.1. 


Remark 2.2.2 The difficulty of SIS problem decreases when m becomes larger, 
while it increases as n becomes larger. In fact, if z is a solution of SIS, ,4,8,m; M > mM, 


[A, A’] is the coefficient matrix of SIS, 4,8’. Let z’ = (5). then 


[A, A’]z’ = [Az, 0] = 0 (mod q). 


So z’ isa solution of SIS, 4,8m- Ifa solution satisfies n + 1 equations of SIS problem, 
it also satisfies n equations of SIS problem. Therefore, the difficulty of SIS problem 
increases when n becomes larger. 


Lemma 2.2.1 For any positive integer q, any A € Z", and p > mq, the SIS 
problem has a nonzero solution; i.e. there exists a vector z € Z", z # 0, such that 


Az = 0 (mod q), and |z| < £. 


Proof Letz = | : | € Z”, we consider the value of coordinate z; in 0 < z; < q A 


Zm 
It’s easy to check that there are more than q” such integer vectors. Thus, we can find 
z’ and z” such that z’ Æ z”, Az’ = Az” (mod q), i.e. 


A(z’ — z") = 0 (mod q), and |z’ — z”| < /mqn < B. 


We complete the proof. 


By the above Lemma and Remark 2.2.1, in order to guarantee there is a non- 
trivial solution of the SIS problem, we always assume the following conditions of 
parameters 

n<m, J/mq™ <B <q. (2.2.2) 


Since the difficulty of SIS problem decreases when 6 becomes larger, we always 
suppose that 
P = mq”. (2.2.3) 


Furthermore, we call n as the security parameter of SIS problem, m = m(n), q = 
q(n), B = p(n) are functions of n. By (2.2.2) and (2.2.3), if m and q are polynomial 
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functions of n written as m = poly(n), q = poly(n), then £ is also a polynomial 
function of n, i.e. 6 = poly(n). Let U Zro be all the n x m random matrices 
uniformly distributed on Z4, we call all the possible SIS problems as SIS, mn, i.e. 


SIS 9m = {4 (n), UZ) PAICE 


SIS, ,m problem is called the total SIS problem, which plays an ‘average case’ role 
in the Ajtai reduction principle. The parameters are selected as 


m = poly(n), q = poly(n), g* = O(1) > $ = O(/m). (2.2.4) 


Definition 2.2.2 Let A € U (Zp) SIS’n.g,6,m problem is to find z € Z”, z ¢ 2Z”, 
such that 
Az = 0 (mod q), and |z| < £. 


In fact the goal of SIS’ problem is to find a solution of SIS problem with at least 
one odd integer of all the coordinates. The relation between solutions of the two 
problems could be summarized in the following lemma. 


Lemma 2.2.2 Suppose q is an odd integer, then there is a polynomial time algorithm 
from the solution of SIS problem to SIS’ problem. 


Z1 
Proof If z= | : | € Z” is a solution of SIS problem, then there exists an integer 
Zn 
k > 0, such that 2-*z ¢ 2Z”. Let z’ = 2-*z, since q is an odd integer, based on 
Az = 0 (mod q), we have 


Az’ =2-*Az = 0 (mod q), 


and |z’| = 2~*|z| < 2-*B. This means z’ is a solution of SIS’ problem. The com- 
plexity of calculating z’ from z is polynomial (polynomial function of n), and this is 
because 

Time{compute z’} = O(nlog’q) = poly(n). 


The above formula also holds even if q is an exponential function of n. 


SIS problem and Ajtai-Dwork cryptosystem have close relation. Let f4(z) = Az 
be Hash function, z’ and z” be the collision points of f4(z), then 


falz) = fale") (mod q) > A(z’ — z”) = 0 (mod q). 
It’s easy to obtain a solution of SIS problem if we can find two collision points of 


fa. In this sense, Hash function f4(z) is strongly collision resisted. The security of 
Ajtai-Dwork cryptosystem mainly depends on the difficulty of solving SIS problem. 
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SIS problem could be regarded as the shortest vector problem in the average case. 
Let 
A; (A) = {z € Z” | Az = 0 (mod q)}. 


Then AS (A) is an m dimensional qg-ary integer lattice. In fact, solving SIS problem 
is equivalent to find the shortest vector of A+(A). 

If AcU (Zr) is the coefficient matrix of SIS problem, we can discuss SIS 
problem by transforming it to Hermite form. Let rankA = n, the matrix A; € Zp” 
constructed by the first n column vectors of A is an invertible matrix. Suppose 
A =[A}, A2], replace A with A, A, we have 


A, 'A=Lh, A= Aj‘ Al. (2.2.5) 


Since A, is a random matrix uniformly distributed, by Lemma 2.1.1, A is also a 
uniform random matrix with dimension n x (m — n). 


Lemma 2.2.3 The solution set of SIS problem with coefficient matrix A is the same 
as that of coefficient matrix Am 


Proof Letz € Z” such that 
Az = 0 (mod q), and0 < |z| < £. 
Then Aj Az = 0 (mod q), z is the solution of SIS problem with coefficient matrix 


A, /A. On the other hand, if Ay'Az = 0 (mod q) = Az = 0 (mod q), Lemma 2.2.3 
holds. 


We call the coefficient matrix Ay A determined by (2.2.5) as the normal form of 
SIS problem. 

Finally, we define some hard problems on lattice. We always suppose L = L(B) C 
R” is a full-rank lattice, à1, A2,..., A, are the lengths of the continuous shortest vec- 
tors in lattice L, à; is the length of shortest vector in L, y = y(n) > 1 is a positive 
function of n. 


Definition 2.2.3 (1) SVP: find a nonzero vector x in lattice L such that 
Ix] < y(m)ai(L). (2.2.6) 
(2) GapSVP,,: determine the minimal distance 4; = à; (L) of lattice L, 
AV(L) < 1, or Ay (L) > y(n). (2.2.7) 


(3) SIVP,,: find a set of n linearly independent lattice vectors S = {s;} C L, such 
that 
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|S] = max |s;| < y (n)àn (L). (2.2.8) 


(4) BDD,: let d = à, (L)/2y (n) be the decoding distance of lattice L. For any 
target vector t € R”, if 


dis(t, L) = min |x — t| < d = M (L)/2y (n), (2.2.9) 


then there exists only one lattice vector v € L = |v — t| < d. The bounded decoding 
distance problem BDD, is to find the only lattice point v. 


The above Definition 2.2.3 gives four kinds of hard problems on lattice. SVP, 
is called the approximation problem of the shortest vector. GapSVP, is called the 
determination problem of the shortest vector. SIVP,, is called the approximation 
problem of the shortest linearly independent group. BDD, is called the approxima- 
tion problem of bounded decoding distance problem. 

Since parameter y(n) > 1, the bounded decoding distance d satisfies 


1 
d = à (L)/2y (n) < z^ (D). 


If the target vector t € R” satisfies the above decoding distance, i.e. dis(t, L) < d, it 
is easy to see there is only one lattice vector v € L => |v — t| < d. In fact, if vı € L, 
v E€ L > |v; — t| <d, |v — t| < d, by triangle inequality 


|v; — v2| < [vı — t| + [v2 — t| < 2d <A, (L). 


This has a contradiction with that the minimal distance of lattice L is à; (L). 

The Ajtai reduction principle is said that the above SIVP,, and GapSVP, problems 
are polynomial equivalent with average case SIS problem. We will prove this in the 
next section. 


2.3 INCGDD Problem 


Let S = {a;} C R” be a set of vectors in R”, we define 
[S| = max |ay;|. (2.3.1) 


Definition 2.3.1 Let L = L(B) C R” bea full-rank lattice, S = {a), @2,...,@,} C 
L be a set of any n linearly independent vectors in L, t € R” be the target vector, 
r > y(n) (B) be areal number. INCGDD problem is to find a lattice vector a € L 
such that 


1 
Pst ee (2.3.2) 
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where g, y (n) and @(B) are parameters. Under the given parameter system, INCGDD 
problem could be written as IN CGDDÎ, ss 


Remark 2.3.1 The key of the INCGDD problem is that for the set S of any given 
n linearly independent vectors and any target vector t € R”, to find a lattice point 
a € L,such that the distance between a and the target vector is no more than 4| S| + r. 
By the nearest plane algorithm of Babai, for any S and f, there exists a polynomial 
algorithm finding 


1 
la = t| < 5vals|. (2.3.3) 


In general, the above formula cannot be improved. We can give a counterexample. 
Let L = Z”, S = I, be an identity matrix, the target vector t = G, L, seng 1), then 
Væ € Z”, we have 


n 1 1 
la —t| > [f= i z v”ISl. 


So there is no lattice point œ with the distance no more than HS | from ż. 


Based on the above counterexample, the parameter selection for INCGDD prob- 
lem is generally g = 4. r in (2.3.2) is called the controlled remainder, which could 
guarantee the existence of lattice vector œ. Under given parameter system, the 
INCGDD problem can be transformed into the SIS problem of the corresponding 
parameter system. This transformation is the key idea of Ajtai reduction principle. 
We call this transformation algorithm the oracle algorithm, written as A(B, S, t). 


oracle algorithm A(B, B, 0). 


We first explain how the oracle algorithm works in a very special case. Let S = B 
be the generated matrix of L, the target vector t = 0, parameters of corresponding 
SIS problem are as follows 


q(n) = nt, m(n) = nlogn, p(n) =n. (2.3.4) 


Since B > ./mq™, by Lemma 2.2.1, the total SIS problem SIS,,m has a solution. 
The oracle sampling algorithm that converts the INCGDD problem into the SIS 
problem is actually a probabilistic algorithm, which can be divided into the following 
four steps. 
The first step: let F(B) be the basic neighbourhood of L = L(B), defined by 


F(B) = {Bx | x € [0, 1)"}. 
We select a point c € F(B) uniformly in F(B). Let y € L be the nearest lattice 


vector to c, we obtain a pair of vectors (c, y). Repeat this process independently m 
times and get m pairs of vectors (c1, y1), (C2, Y2), +++; (Cm, Ym), here m > n. 
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The second step: for each c; (1 < i < m), we define ¢;, 
& = BlqB™'ci]/q, 1i <m. (2.3.5) 
Let c; = Bx;, where x; = (Xi, Xi, ---, Xi)" € [0, 1)", so we have 
1 4 1 1 1 
—[q4 B ci] = (—[9xi,], —laxin].---, —[9%i, l). 
q q q q 
Each coordinate satisfies 


0< Lqxi,] S xi, <1, j=1,2,...,n. 


Q le 


Thus, ¢; € F(B). Let c; — Ĝ& = Bu;, vi = (Vi, Un, ..-, Vi)”, then 


1 1 
0< v, =x, — lgx] < -. (2.3.6) 
q q 


Therefore, the distance between ĉ and c; has the following estimation. Suppose 
B=[fi,..., n], it follows that 


n 


n 
Iê — cil = 1 > Arval < > loi, 11 Bel 
k=1 


k=1 


n 1 . 4 

< -|B| = = IBI. (since q = n“) 
q n 

The above formula holds for all 1 < i < m. We can give a geometric interpretation 

of ¢;. Divide the basic neighbourhood F (B) into q” polyhedra with side length a 

and each polyhedron is denoted as A;, where 

r k-1 


k 
, ie < -, Lek <q}. 
q q 


A; = {Bx | x = (x1, X2,..., Xn) 


Since {c;}/_, are uniformly distributed in F (B), each polyhedron A; contains at least 
one c point under positive probability, written as c;. Based on Vol(A;) = z det(L), 
so 


1 
Pr{ci € Ai} = — > 0. (2.3.7) 
q” 


According to (2.3.5), both ĉ and c; are contained in the polyhedron A,, and ¢; is the 
point at the bottom left corner of A;. From Lemma 2.1.3, since {c;} is uniformly at 
random in F (B), then zla B~'c;] is uniformly distributed. Based on Lemma 2.1.1, 


{Â} is also uniformly distributed at random. Let 
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C= lei C2, 2065 Cmlixm- 
Y = Ly, y2, <--> Ymlnxm- (2.3.8) 
C= [â, Ô, e.’ Čmlaxm: 


We get three n x m matrices. 
The third step: now we define m n dimensional vectors a; € Zi l<i<cminZ, 


a; = [qB !c;] (mod q), 1 Si <m. 


Then 
A = [a], a2, ... , amlnxm € A (2.3.9) 


According to Lemma 2.1.3, A is a random matrix uniformly distributed. Suppose z 
is a solution of SIS, mg problem, i.e. 


Az = 0 (mod q), and0 < |z| < , z € Z”. 


Combining z and {Â}, 
A 1 
Cz = [B[qB™'c1]/4, .--, BIB" 'cm)/q]z = B - 7“ € L(B). 


Since Az = 0 (mod q) > Az € Z”, we get a lattice vector ĈzeL. 
The four step: Similarly, combining z and {c;}/_,, {y;}7_,, we get two vectors Yz 
and Cz. Let z = (Z1, Z2,.--, Zm)” , then 


Z1 

Z2 m 
Yz=[y1, yaen] ; = zayi EL. 

: i=l 


Zz m 


Both Ĉz and Yz are lattice vectors, let a = Ĉz — Yz = (Ĉ — Y)z € L. We are to 
prove that @ is a solution of INCGDD problem. Denote |z|; as the /; norm of z, it 
follows that 


m 


Izh = J lzil < vmlzl. (2.3.10) 


i=1 


The major part of the length ofa = Cz — Yzis |Cz — Cz, which could be estimated 
as follows 


A m 5 n n/m 
ICz— Cal = 1} (e: — &zl < ZIBI < nÉ s, (2.3.11) 


i=1 
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Select the parameters m = nlogn, q = nt, B = n, when n is sufficiently large we 
have, 


R 1 
ICz — Cz| < 4 4l- 


The minor part of length |Cz — Yz| of œ could be calculated by the nearest plane 
algorithm of Babai [see (2.3.3)]: 


1 
ICz — Yz| < Vn Bl. 
Let 6(B) = |B|, y(n) = 3,/n, then 
A A 1 
jæ] = |Cz — Yz| < |Cz —Cz| + |Cz — Yz| < rita +r, 


where r > y(n)(B). In other words, based on a solution z of the SIS, n,g problem, 
we can get a solution of the IN CGDD?, g Problem for generated matrix B and the target 
vector tf = 0 by a probabilistic polynomial oracle algorithm. Here the parameters are 
chosen as g = 4, y(n) = iyn, (B) = |B]. 

The above oracle algorithm is a simple simulation of the reduction principle for 
INCGDD problem by setting S = B and the target vector t = 0. Given any n linearly 
independent vectors S = {a),a@2,...,@,} C L and target vector t € R”, general ora- 
cle algorithm A(B, S, t) will complete the whole technical process of transforming 
the INCGDD problem into the SIS problem, which is the core idea of Ajtai reduction 
principle. We begin from two lemmas. 


Lemma 2.3.1 (Sampling lemma) Let L = L(B) C R” be a full-rank lattice, F (B) 
be the basic neighbourhood, t € R" be the target vector, s > n_(L) be a positive 
real number. Then there exists a probabilistic polynomial time algorithm T (B, t, s) 
to find a pair of vectors (c, y) € F(B) x L(B) such that 

(i) The distribution of vector c € F(B) is within statistical distance sé from the 
uniform distribution over F (B). 

(ii) The conditional distribution of y € L given c is discrete Gauss distribution 
DLs a+) 


Proof The process of sampling algorithm T (B, t, s) could be proved as follows: 
1. Since the density function of Gauss distribution Ds, (x) is 


1 x 2 
= = glai 
Ds (x) = m? 3? , 


the corresponding random variable is denoted as D, ;. Let r € R” comes from dis- 
tribution D, ,, and r is called the noise vector. 
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2. Let c e F(B), c= —r (mod L), y =c +r € L be output vectors, (c, y) be 
the output result. 
Since r is generated by Gauss distribution in R”, it follows that c has the distri- 
bution — D, ; mod L in the basic neighbourhood F (B). We can prove 
— Ds, mod L = Ds,- mod L. (2.3.12) 


Then the statistical distance between the c and the uniform distribution on F(B) is 


A(c, U(F(B))) = A(— Ds „mod L, U(F(B))) = A(D,,-, mod L, U(F(B))) < =e. 


Nie 


On the other hand, y = c +r € L, if cis fixed, the distribution of y € L is the discrete 
Gauss distribution Dz_s (++). We complete the proof. 


Lemma 2.3.2 (Combining lemma) Let q be a positive integer, L = L(B) C R” bea 
full-rank lattice, F (B) be the basic neighbourhood. For any full-rank subset L(S) C 
L(B), where S = [a1, 2, ..., æn], there is a probabilistic polynomial time algorithm 
T,(B, S), for m vectors C = [c1, C2, . . . , Cm] uniformly at random in F(B), we can 
find a random matrix A € Z” uniformly distributed and a lattice vector x € L(B), 
such that 


1 
Ix —Cz| < cowimisilzh (2.3.13) 


where z € Z", and Az = 0 (mod q). 


Proof Suppose {a, a@2,...,@n,} C L aren linearly independent lattice vectors, and 
S = [a1,Q2,...,@,] generates the full-rank lattice L(S) C L(B). Let FS) be the 
basic neighbourhood of lattice L(S). It is easy to see that F(B) C F(S). For any 
m vectors {c;}/., uniformly distributed in F(B), we can choose m lattice vectors 
{U1, V2, ..., Um} C L(B) by sampling lemma. The corresponding vector in the basic 


neighbourhood F (S) is denoted as v; mod L(S), such that 


{v; mod L(S)}"_, C F(S) are uniformly distributed. 


i=] 
In other words {v;} is selected from the quotient group L(B)/L(S), satisfying v; Æ 
vj (mod L(S)), and {v; mod L(S)}"_, are uniformly distributed in F(S). We still 
write v; (mod L(S)) as v;, and let 
wi = ci + v; mod L(S), i=1,2,...,m. 


It follows that {w;} is uniformly at random in F (S). For 1 <i Æ j < m, we have 


v; Æ vj (mod L(S)) > v; + F(B) # vj + F(B) (mod L(S)), 
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so {v; + F(B)}""_, forms a split of F (S) with the same volume. We get {w;} C F(S) is 
uniformly distributed according to {v; } is uniformly at random. Suppose the following 
two matrices C and W are 


C = [c1, C2, CE Cm]; W = [w1, w2, aa i Wml. (2.3.14) 
Define m vectors uniformly distributed in Z% as 
ai = [qS~'w;] (mod q), i = 1,2,...,m. (2.3.15) 


By Lemma 2.1.3, since {w; } is uniformly atrandomin F (S), then A = [a1, a2, .. . , am] 
is an n x m dimensional uniform matrix, A € Zy Letz € ^g (A), then 


z e Z” 


g and Az = 0 (mod q). 


Define the vector x i 
x=(C—W+4+-SA)z. (2.3.16) 
q 


We first prove x € L(B) is a lattice vector. From the definition of vector x, we have 


1 m 1 
x=(C-W+ 734x = Va — wz + 734 


i=l 


Note that 
ci — wi = (CG + v) — wi) — vi, 1Si <m, 


since c; + v; = w; (mod L(S)) => 
ci +v; — wi € L(S) C L(B), 
and each v; satisfies v; € L, it follows that c; — w; € L, 1 <i < m. On the other 


hand Gaz € Z", we get 7 SAZ € L(S). Thus, we confirm that x € L. Finally, we 
estimate the distance between x and Cz. 


m S 1 m 
Ix = Cz] = |$ (wi — Sade = -1S $ (u; — les zil, (2.3.17) 
i=l q 2 3 
dı 
d 
where u; = q S7! w;. It is easy to see, for any d = | . | € R”, 
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n n 
|Sd| =|} disil < Yo Idillsil < |Slldh. (2.3.18) 
i=l i=] 


Since 


m m 


m 
(X u = eDaily < YO lze — will <n zi] < nvm], 
i=l 


i=1 i=l 


by (2.3.17) and (2.3.18) we get 


1 
Ix = Czļ| < ee: 


So we finish the proof. 


2.4 Reduction Principle 


The Ajtai reduction principle is to solve hard problems on lattice in general case. For 
example, SVP, SIVP and GapSVP problems can be transformed to SIS problem by 
a polynomial algorithm with positive probability, so the difficulty of SIS problem is 
polynomial equivalent with that of lattice problems. This principle from general to 
average case is called Ajtai reduction principle from the worst case to the average 
case in academic circles. 

We start by proving that the INCGDD problem could be transformed to the SIS 
problem. Denote the INCGDD¢, g problem with parameters as {B, S, t, r}. For any n 
linearly independent vectors S in a full-rank lattice L = L(B) and any target vector 
t € R”, our goal is to solve a lattice vector s € L such that 


1 
ls = t| < —|S| +r, (2.4.1) 
g 


where g > 0 is a positive real number, r > y (n)ọ (B). 


Theorem 2.4.1 (From INCGDD to SIS) Given parameters g = g (n) > 0, m, B are 
polynomial functions ofn, i.e.m = n°, B = n? ™®, € = e(n) is anegligible function 
ofn, ie. € < + (k > 0), (B) = ne(L), and 


y(n) = B(n)Jn, q = qn) > g(n)nV/mB(n). (2.4.2) 


Under the above parameter system, there is a probabilistic polynomial algorithm, 
which could transform the INCGDD§, g problem to the SIS problem. 
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Proof The probabilistic polynomial algorithm in Theorem 2.4.1 is called the oracle 
algorithm, written as A(B, S, t). In the last section, we introduce the oracle algorithm 
detailedly in special case with S = B and the target vector t = 0. Now we give the 
work procedure of general oracle algorithm A(B, S, t) by sampling Lemma 2.3.1 
and combining Lemma 2.3.2: 

1. Select two integers j and œ uniformly at random, such that 


j€{l,2,...,m}, -B<a<B,a£0. 


For a given target vector ¢ € R”, and positive integer j, we define m vectors t; (1 < 
i <m)as 


1 “pe ; 
_]—z6 i=j. 
ti = | e (2.4.3) 
2. For each i = 1, 2,...,m, according to the sampling algorithm T (B, ti, +) in 


Lemma 2.3.1, i.e. lett = ti, s = Žr, we get 
(ci, yi) € F(B) x L(B). 


Note that r > y(n)@(B), so 
2r 
s= a > 2(B) = 2n.(L). 


3. Define two matrices 


C= [c1, C2, eg mh Y = Ly, X2, sea Yak 


4. Based on the given matrices S$ C L(B), C € F(B)” and the parameter q, we 
can find a uniform random matrix A € Z4”, a solution z of the corresponding SIS 
problem, and a lattice vector x € L(B) by the combining algorithm in Lemma 2.3.2 
satisfying 

1 S 
|x — Cz| < —nJ/m|S||z| < a (2.4.4) 
q g 

5. Let s = x — Yz, then s € L(B) is a solution of the INCGDD problem, such 

that 


1 
|s — t| S Pa +r (2.4.5) 


holds with a positive probability. The above oracle algorithm A(B, S, t) could be 
represented in the following graph 
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t > (c1, y1) 
n Sampling g CeF(B)” [W e F(S)”] Combining [x € L(B) 
t e R? ——> : o nxm | — > m >s 
Algorithm , YeL(By" | Ae Zg Algorithm | z € Z 


tm > (Cm, Ym) 


Since x, Yz € L(B), it follows that s = x — Yz € L(B). Next we are to estimate 
the probability that the inequality |s — t| < AD) | +r holds. We write ô > 0 as the 
positive probability when solving the SIS problem successfully. The event H; « 
denotes getting a solution z = (Z1, Z2,..., Zm)” of the SIS problem with zj = a, 
and its probability is 6;,,, where 1 < j < m, —B <a < p, a £0. If we obtain a 
solution z of the SIS problem successfully, then at least one of these 2B events H; « 


occurs. Therefore, 
X bja > ô, 
ja 


there is a pair of j, œ such that Pr{H; 4} = dj 2 > 0. We assume that the 


ô 
2m8 
event H; « occurs and estimate the conditional probability of |s — t| < HIS | +r. Let 
T = [ti, to,..., tm], then Tz = t;z; = —t. By the triangle inequality, i 


S 
EEE EA ea n< Ë+ C- Tx. 


We have i 
Pr{|s —t| < —|S| +r} > Pr{(Y —-C-T)z| <r}. 
g 


Based on the sampling Lemma 2.3.1, y; has discrete Gauss distribution Dz (B), 2 e+- 
According to Lemma 2.4.2 in Sect. 1.4, it follows that 


2 1 € 2F 5 
Ellyi — (ci + t) < G+ )(—)n, 
2m l-e y 
and E 
€ r 
EL — (ci + tD? < (Sn. 
l-e y 
Since y1, y2,.-., Ym are independent, by Lemma 4.6 in section 1.4, 


€ 


m 
1 € 2r 1 2r 
Ell Oi — Gi + tizi] < = + +m(—)*)(—)? nz? < 2(—)?nlzl?. 
a 2m l-e l-e y y 


Combining |z| < 8 and y = B./n, we get 


1 2 2 
EI = € = TPI < gE nle < r. 
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Using Chebyshev inequality, 


Pr{|(¥ -C - T)z| >r} < JEI - C- Tz] < 


WIN 


By (4.6), 


w| = 


1 
Prijs — t| < -S| +r} > Pr{|(Y -C - T)z| <r} > 
8 
Note that the above inequality holds under the assumption H; «, i.e. 


w| = 


1 
Pr{|s — t| < —|S| +r | Hja} > 
& 


Finally, we have the estimation 


1 1 
Pri =e) <8 47S Pile 41S S| FR al 
8 & 
Hee Stee Pies <-s0 
= Pr{|s—t| < — r | Hja}: Pr{Hjo} 2 => > 0. 
g k 2 3 2mß 


This means |s — t| < ziS | +r holds with a positive probability, so we complete the 
proof of Theorem 2.4.1. 


In the above proof, we have completed the whole process of transforming the 
INCGDD problem to the SIS problem, and prove that the difficulty of the INCGDD 
problem is polynomial equivalent with that of the SIS problem. This realizes the 
reduction principle from the worst case to the average case, which is the main result 
we introduce in this section. For hard problems on lattice, such as SIVP and GapSVP 
problems, based on Theorems 5.19, 5.22 and 5.23 in Micciancio and Regev (2004), 
we can transform them to the SIS problem equivalently. By Theorem 2.4.1, the 
difficulty of hard problem on lattice is polynomial equivalently with that of the SIS 
problem. In addition, the following Theorem 2.4.2 provides another way of reduction 
from SIVP to SIS problem. 


Theorem 2.4.2 (From SIVP to SIS) Let the parameter m be a polynomial function 
ofn, ie. m = n?™®, B > 0, q > 2Bn°™, y = Bn?®, then the difficulty of solving 
the SISn.q,p,m problem by a probabilistic polynomial algorithm is not lower than that 
of the SIVP,, problem. 


Proof We are to prove that if there is a positive probability polynomial algorithm to 
get the solution of the SIS, 4,4,m problem, so is the SIVP, problem. In other words, 
we can find n linearly independent vectors S = {s;} C L, such that |$| = max |s;| < 
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y (n)àn (L). Based on a set of linearly independent lattice vectors $ C L (S is initially 
the generated matrix B of lattice L), the idea of the reduction algorithm is using the 
oracle algorithm to obtain a set of new linearly independent lattice vectors S$’ C L 
satisfying |S’| < |S|/2. Repeating this process and we can finally get the solution of 
the SIVP, problem. Let q > 2Bf(n), f(n) be a polynomial function of n. We give 
the work process of this reduction algorithm. 

1. According to the sampling lemma and combining lemma, generate m short 
vectors v; € L in the basic neighbourhood of lattice L(S) such that |v;| < |S| f (n), 
i=1,2,...,m, V = [vq, v2,..., Uml. 

2. Let A = B~'V (mod q), by the combining lemma we know A is uniformly 
distributed in Lies Solve the SIS problem Az = 0 (mod q) with |z| < 6 and obtain 
a solution z. 

3. Let s = Vz/q. Repeat these three steps and generate enough vectors s so that 
there are n linearly independent vectors, denoted as 51, 52, ..., Sn. Suppose the matrix 
S' is S’ = [s1, 50, ..., Sn]. 

We are to prove that |S'| < |S|/2. Firstly, note that s € L. This is because 


Vz = B(Az), Az = 0 (mod q), 
so B(Az) € qL and s = Vz/q = B(Az)/q € L. Secondly, 
Is] = |Vz|/4 < |VIB/¢ < |S| f(™)B/2BF(n)) = |S|/2. 


This means |S’| < |S|/2. Replace S with S’ and repeat the above three steps until 
|S’| < y(n)A,(L), then we confirm that S’ is a solution of the SIVP, problem. 


At the end of this section, we show that the difficulty of some other hard problems 
on lattice are polynomial equivalently with that of the SIS problems. We give another 
two definitions about hard problems on lattice. 


Definition 2.4.1 (1) GIVP9: find a set of n linearly independent vectors S = {s;} C 
L, such that 
|S] = max |si| < y (n) (B), (2.4.6) 


where y(n) > 1 is a positive function of n, B is the generated matrix of L, and ¢ is 


areal function of B. 
(2) GDDŻ: let t € R” be a target vector, find a vector x € L, such that 


Ix = t| < y(n) (B), (2.4.7) 
where B is the generated matrix of L, and ¢ is a real function of B. 


If = i, is the nth continuous minimal distance of lattice L, the GIVP? problem 
in the above definition becomes the SIVP, problem in Definition 2.2.3. Here we 
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give two lemmas to show that the above two problems could be reduced to the SIS 
problem. 


Lemma 2.4.1 For any function y(n) > 1 and ¢, there is a polynomial reduction 
algorithm from GI VP$, to IN CGDD% ; problem. 


Proof Suppose B is a generated matrix of lattice L, our goal is to find a set of n 
linearly independent vectors S$ = {s;} C L such that 


[S] = max |s;| < 8y (n)$ (B). 


We use the idea of iteration to achieve this goal. Initially, let S = B. If S satisfies the 
above condition, then the solution has been found. If S does not satisfy the above 
inequality, assume S = [s, 52,..., Sn], and suppose that 


[Sn| = max |s;|, 
l<i<n 


i.e. s, is the longest vector among s1, 52,...,5,. Let t be a vector orthogonal to 
S1, S2, ---, Sn—1, and |t| = |S|/2 = |s,|/2. Here the vector t can be constructed by 
the Schmidt orthogonalization method. Based on the reduction algorithm in Theo- 
rem 2.4.1, we solve the INCGDD problem with parameters {B, S, t, |S|/8}. If the 
algorithm fails, then we have 


S 
pè Si < y(n)p(B) > |S| < 8y (n) (B). 


This implies S is a solution of the GIVP$, problem. If the reduction algorithm solves 
the INCGDD problem successfully, then we get a vector u, such that 


ju — t| < Isl +r= Isi 
It follows that 
|u| < |t| + UE a 
u — = —. 
> 4 4 
Itis easy to verify u, 51, 52, ..., S,—1 are linearly independent. Otherwise, u is orthog- 
onal to ¢ since ¢ is orthogonal to s1, 52, ..., 5,1. Thus, 
IS}? 2 2 2 z SP 
— 2 |u — t| = |u| + |t| è |t| = —. 
g > -tÊ = uÊ +? > t = a 
It is a contradiction. So u, S1, 52,...,5,—-1 are linearly independent. Let S’ = 
[51, 52, .-+5 Sn-1, U], |S’| < |S], repeat the above process for S’ and we get a solution 


of the GIVP$, problem finally. Lemma 2.4.1 holds. 
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Lemma 2.4.2 For any function y(n) > 1 and ¢, there is a polynomial reduction 
algorithm from GDD$, to INCGDD% ; problem. 


Proof Assume B is a generated matrix of lattice L, t € R” is the target vector. Our 
goal is to find x € L, such that 


Ix = t| < 3y (n) (B). 


According to Lemma 2.4.1, we can find a set of n linearly independent vectors 
S = {s;} C L such that |S| < 8y (n) (B). Let r be a real number satisfying the 
INCGDD problem with parameters {B, S, t, r/2} fails, and {B, S, t, r} successfully 
solves a solution x. In fact, the real number r in this range r/2 < y(n)@(B) <r 
could satisfy the above condition. It follows that 


S S 
pe = ree a + 2y(n)$(B) < 3y (n)o(B). 


So we get a solution of the GDD§, problem. We complete the proof. 


In Lemma 2.4.1 and Lemma 2.4.2, we transform the GIVP? and GDD? prob- 
lems to the INCGDDŻ, g problem. While Theorem 2.4.1 tells us the difficulty of the 
IN CGDDÎ, g problem is polynomial equivalent with that of the SIS problem. So we 


have proved that the GIVP? and GDD¢ problems are polynomial equivalent with the 
SIS problem. 
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Chapter 3 A) 
Learning with Error rie 


Learning with error was proposed by O. Regev in 2005 (see Regev, 2009), which can 
be regarded as a dual form of SIS problem. LWE has very important applications in 
modern cryptography, such as LWE-based fully homomorphic encryption. The main 
purpose of this chapter is to explain the mathematical principles of the LWE problem 
in detail, especially the polynomial equivalence between the average LWE problem 
and the hard problems on lattice, which is one generalization of the Ajtai reduction 
principle and solves the computational complexity of the LWE problem effectively. 


3.1 Circulant Matrix 


Circulant matrix is a kind of simple and beautiful special matrix in mathemat- 
ics, which has important applications in many fields of engineering technology. In 
Sect. 7.7 of “Modern Cryptography’, we explain and demonstrate the basic properties 
of circulant matrix in detail. See the monograph Zheng (2022) on circulant matrices 
for more details. 

Let T be a square matrix of order n, 


(3.1.1) 


where J,,_; is the n — 1 dimensional unit matrix. Obviously, we can define a linear 
transformation x —> Tx, x € R” of R” > R” by T. The characteristic polynomial 
of T is f(x) =x" — 1, so T” = I. We use column notation for vectors in R”, and 
{e0, €1,..-, €n—1} is the standard basis of R”, i.e. 
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1 0 0 
0 1 0 
eo=|9J,a=]9],...,e4= ]:]. (3.1.2) 
0 0 1 


Denote em as ex, if m = k (mod n), and O < k < n — 1, it is easy to see 


Tex = x41, and T (e0) =e, 0OSk<n-l. (3.1.3) 
ao 
Definition 3.1.1 Let a = : € R”, the circulant matrix T* (œ) generated by 
An—1 
a is defined by 
T*(a) =[a, Ta,..., T” @]Jnxn € R". (3.1.4) 


It is easy to verify that the circulant matrix B generated by the linear combination 
vector is the linear combination of the corresponding circulant matrices, i.e. 


T*(aa + bB) = aT* (a) + bT*(B). (3.1.5) 
ao 

Specially, for any a = : € R”, the circulant matrix T*(a@) generated by a 
Qn-1 


could be written as 


n—-1 n=l 
T*(a) = T* (x asi = J aiT* (ei), (3.1.6) 
i=0 i=0 
therefore, any circulant matrix is the linear combination of circulant matrices gener- 
ated by the standard basis vectors e;. It is easy to verify that 
T*(e.) =T*, 0O<k<n-1. (3.1.7) 
In particular, the unit matrix J, is a circulant matrix generated by the vector eg. The 


basis properties about the circulant matrix are summarized in the following lemma, 
and the corresponding proofs could be found in Sect. 7.7 in Zheng (2022). 


alo Bo 


1 
Lemma 3.1.1 Leta = À ,p= : be two vectors in R", then we have 


Qn-1 Bn—1 


3.1 Circulant Matrix 55 


(i) T*(@) = doln +ayT +--+ + ai TR 
(ii) T*(œ) - T* (B) = T*(B) - T* (œ). 
(iii) T*(a)-T*(B) = T*(T*(@)B). 
(iv) det(T*(a)) = T- a(wi), where w; is the n-th unit root. 
(v) T*(q@) is an invertible matrix if and only if the characteristic polynomial a(x) = 
ao Fax +++ + Anax”! 
(a(x), x" — 1) = 1. 


corresponding to a and x" — 1 are coprime, i.e. 


We take the characteristic polynomial x” — 1 as modulo and construct the one-to- 
one correspondence between polynomial quotient rings and n dimensional vectors, 
which is called the geometric theory of polynomial rings. We consider the following 
three polynomial quotient rings. Let R[x], Z[x] and Z,[x] be the polynomial rings 
of one variable on R, Z and Z, respectively, defined by 


n—-l 
R = R[x]/ <x" — 1 >= [Zaria eR}, (3.1.8) 

i=0 

n—l 
R = Z[x]/ < x" — 1 >= [S ariaez], (3.1.9) 

i=0 

and 
Ry = Z4lx]/ < x” — 1 >= [Sar aez}. (3.1.10) 

i=0 


In fact, the right hand side of the above formula is a set of representative elements 
of the polynomial quotient ring. 

For any a(x) = @ + ax +- -- + &n—1x”7! € R, we construct the following cor- 
respondence 


a(x) = ao + aix +- + anx"! E€ R 4> a = . e R”, @G.1.11) 


Qn-1 


written as a(x) <—> a ora <— a(x). Then (3.1.11) gives a one-to-one correspon- 
dence between R and R”. In the same way, w(x) <—> « also gives the one-to-one 
correspondences of R —> Z” and Ra > Z}. It is not hard to see that the above 
correspondence is an Abel group isomorphism. To establish ring isomorphism, we 
introduce the concept of convolution multiplication of vectors. 


Definition 3.1.2 For any two vectors a, 6 in R”, Z” or Zi we define the convolution 
a @ B by 
a Q B = T* (Œ). B. (3.1.12) 


56 3 Learning with Error 


Under the above definition, R”, Z” and Zi become a commutative ring with unit 
element, respectively. Obviously, the convolution defined by (3.1.12) is closed on Z” 
or Zi: Ifa € Z", then T*(a@) € Z”*”, thus, a ® B = T*(a)B € Z”, so is Zi: Based 
on the property (iii) of lemma 3.1.1, 


T*(a @ B) = T*(T*(@)B) = T*(@)T*(B) = T*(B)T*(@) = T* (£ @ a), 
so we have a ® f = £ & a. On the other hand, 
(Qa+a)@B=T*at+a')B=T*(a)B+T*@')p=a@ Bp +a’ @ B, 
hence, R”, Z” and Zi are commutative rings with the same unit element eg. Since 
T*(€) = I, then 
eo @B=T*(eo)B = hp = B. 


Lemma 3.1.2 Suppose R, R and R, are defined by (3.1.8), (3.1.9) and (3.1.10), 
then we have the following three ring isomorphisms: 


RR’, RXZ” and R} = Zi. 
Proof We only prove R = R”, the other two conclusions could be proved in the 
same way. Va(x) € R, a(x) <— a € R” is a one-to-one correspondence and an 
Abel group isomorphism. We are to prove 
a(x) B(x) <> a Q B, Va(x), B(x) ER. (3.1.13) 
Let B(x) = Bo + Bix + +++ + Bn-1x"7}, then 


xB(x) = Box + Bix? +--+ + Ba—2x" | + Bn—1x” 
= Bn-1 + Box Se Ba-2x"7!, 


so x(x) <— TB. For all k, 0 < k < n — 1, we know 
x" B(x) <> T*£. 
Let a(x) = œo + ajx +--+» +a,_;x"!, it follows that 


n—-1 n—-1 


on(x) B(x) = D> agx* B(x) > $ ay T*B = T*(a)B = 0 @ P. 


k=0 k=0 


Therefore, we prove that R = R”. Similarly, we have R = Z” and R} = Zi: 


Since R” is Euclidean space, the Euclidean distances in Z” and Z% could also be 
defined as the Euclidean distance in R”, which is called the embedding of Euclidean 
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distance in Z” and Zi: By Lemma 3.1.2, we treat R,R, R; and R”, Z”, Zi as the same 
and write R = R”, R = Z", R} = Zł: Therefore, the polynomial rings R, Rand R, 
also have Euclidean distance, which constructs the geometry of the polynomial ring. 
For any polynomial a(x) € R, we define 

ja(x)| = ja|, if a(x) a. (3.1.14) 
Lemma 3.1.3 For any a(x), B(x) € R (or R, R,), we have 

lo(x)B(x)| < Vnla(x)| BN. 


Proof To prove this lemma, we only prove that for any œ, 8 € R” (the same as Z” 
or Zg) we have 


læ @ B| < v'nlļal - |Bl. (3.1.15) 
By Definition 3.1.2, 
by 
b2 
a @B=T*(a)B =[a,Ta,...,T” 'a]pB =|. | eR. 
bn 


Let @ be the conjugation vector of a, i.e. 


a Qn-1 
Qa) E An-2 
a= >a= s 
On-1 ao 


then, the circulant matrix T*(œ) generated by œ can be divided into rows 


a TT 

a’ (TTY 

T* (œ) = ; ; 
al (Try 

where T7 is the transposed matrix of T. So b; = @ (T7)'B (1 <i < n) and we get 


Ibil < lal- |B], Leica, 
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It follows that 


Nie 


lx Bl = (£) < Vnla| - I£]. 


We complete the proof. 


Finally we discuss the relation between circulant matrix and lattice. Let B € R”*” 
be a square matrix of order n, the lattice L(B) C R” generated by B is defined by 


L(B) = {Bx | x €Z"}. 


If B is an invertible matrix, then L (B) is called an n dimensional full rank lattice. 


Definition 3.1.3 Let L(B) C R” bea lattice, we call L (B) acyclic lattice, if L (B) is 
closed under the linear transformation T, i.e. for any œ € L(B) we have Ta € L(B). 
If L(B) C Z” is a cyclic lattice, then L(B) is called a cyclic integer lattice. 


Lemma 3.1.4 Let a € R”, then the lattice L(T*(a)) generated by the circulant 
matrix T* (a) is a cyclic lattice, which is the smallest cyclic lattice containing a. 


Proof Based on the definition T* (œ) = [a, Ta, ..., T”~'a], we get 


n-1 
L(T*(a)) = [Sara |a; € z) ! 


i=0 
For any B € L(T*(@)), 


n—-1 
B =} biT'a = TB € L(T*(a)), bi €Z, 
i=0 


so L(T*(æ)) is acyclic lattice. Assume L is a cyclic lattice containing a, since œ € L, 
TaeéL,...,T"'a € L, then any linear combination of integer coefficients 


n—-1 
X aiTia eL>L(T*(a)) CL. 
i=0 


This means that L(T*(œ)) is the smallest cyclic lattice containing a. 


Lemma 3.1.5 Let L(B) C R” be acyclic lattice, a € L(B) be a lattice vector, then 
there is an integer matrix D € Z"*" such that 


T*(a) = BD. (3.1.16) 


Proof Since a € L(B), L(B) is acyclic lattice, then Ta € L(B), T’a € L(B),..., 
T”—!æ € L(B). Let(O<k <n—-1) 
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T*a = Bdk, dy € Z", D = (do, di,..-4dn-t)nxn € Z"™", 
the circulant matrix T*(œ) generated by a could be written as 


T*(a) =[a, Ta,...,T" 'a] = [Bdo, Bd), ..., Bd,_|] = BD. 


Lemma 3.1.5 holds. 


Let L C R” be a lattice, for any x € R”, there exists uy € L > 


Ix—u,]= min ja—x|=|x—Ll. (3.1.17) 
acl asx 


ux is called the nearest lattice vector of x. We define the covering radius p(L) of L 
by 
p(L) = max |x — ux| = max |x — L|. (3.1.18) 
xeR” xeR” 


Obviously, the covering radius p(L) satisfies that any sphere N(x, o(L)) with 
radius p(L) contains at least one lattice vector. If L; C L is a sublattice, then for any 
x eR’, 

|x — L| < |x — Li| > (L) < p(L)). (3.1.19) 


If L = L(B), we write o(L) = p(B). The final goal of this section is to prove 
the existence of the covering radius and give an upper bound estimate of o(L) using 
Babai’s nearest plane algorithm. 

Let L = L(B), S = {51, 52,...,8,} C L be n linearly independent lattice vec- 


tors. S* = {s}, sj, ..., 57} is the orthogonal basis corresponding to S by the Gram- 


7n 


Schmidt method. We define 


o(S) = (È sre) : (3.1.20) 
isi 


Lemma 3.1.6 (Babai) Let L = L(B) C R” be a full rank lattice, S C L be the set 
of n linearly independent lattice vectors, then for any t € R", there exists a lattice 
vector w € L > 


1 
It — wl < 50 (9). (3.1.21) 


Specially, the covering radius p(L) of L exists and satisfies p(L) < $0 (S). 


Proof Without loss of generality, we only prove for the case $ = B. Since L(S) C 
L(B) is a full rank sublattice, by (3.1.21) w € L(S) > w € L(B) and p(L) < 
p(S) S 50 (S). Let B = [£1, B2,..., Bn], the corresponding orthogonal basis is 
B* = [By, B5,..., B=]. Babai’s algorithm is based on the following two techniques: 
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(1) Rounding off (see Theorem 7 of Chap. 7 in Zheng (2022)) 


Yx € R”, let x = )~"_, x;*, where x; € R. Define ô; € Z is the nearest integer of 
Xi, and 


n n 1 1 
[xls = D587, tds =) aup, -5 <a 5 <i <a. 
i=1 i=1 


It is easy to see x = [x]g + {x}g, where [x]g € L is a lattice vector. 
(2) Nearest plane 
Let U = L(B), b2, ..., Bn-1) C R” be ann — 1 dimensional subspace, 


n—-1 
Le > ZB; C L isa sublattice of L. 


i=l 


After x € R” is given, let v € L, such that U + v is the nearest plane of x. Let x’ 
be the orthographic projection of x in U + v, y € L’ be the nearest lattice vector of 
x — v, w = y+ v be an approximation of the nearest lattice vector of x in L. Based 
on the above definitions, we can prove that (see (7.82) of Chap. 7 in Zheng (2022)) 


U= L(pi, b2, sieg Pn) = L(fy, BŽ, vers Bal 


v = nbn E L 
n—1 

x! = } xiBF + 8, Br (3.1.22) 
i=l 

y is the nearest lattice vector of x — v in L’ 

w=ytvel 


Since v = ôn bns x’ = YZI x: B* + bn Be, 
/ * 1 * 
|x — x'| = |Xn — ônll žl < zlÊal- 


The distance between any two planes in {U + z | z € L} is at least |B*|, and |x — x’ 
is the distance of x from the nearest plane, so we have 


|x = x'| < |x — uxl. 
Let w =y+v=yt+6,B, € L, we are to prove 
[x — wl? = |x = x'? + |x’ — w/?. (3.1.23) 
This is because 


x= x! = (Xn — 5,) BF, x’ — w =x'—v-yEU, 


3.2 SIS and Knapsack Problem on Ring 61 


therefore, 
(x —x’)L@’—w), 


and (3.1.23) holds. Based on the assumption: 


(Bi? +--+ + 8al). 


1 
|x’ — w|? =< 4 


It follows that 
1 1 E 
x — wh? < FUP + +P HID = (30%) 
Let x = t € R”, we get w € L such that 


1 
lt-—wl< gee 


This lemma holds. 


The calculation of the covering radius on lattice is also a kind of hard problem. 
We define the covering radius problem (CDP,,) based on parameter approximation. 


Definition 3.1.4 (CDP,,) Let L be a full rank lattice, y (n) be a parameter, CDP, 
problem is to find an r such that 


p(L) <r <y(njp(L). (3.1.24) 


3.2 SIS and Knapsack Problem on Ring 


Let q be a positive integer, Z, be the residue class ring mod q, and Z,[x] be the 
polynomial ring of one variable on Z,. By (3.1.10), we define a quotient ring R, on 
Za [x] 

Ry = Zalx]/ < x” — 1 >S (Z, +, 8). (3.2.1) 


To define the SIS problem on R,, for any m polynomials A = {a)(x),...,@m(x)} C 
R,, A could be regarded as an m dimensional vector in R4, i.e. A = (ai (x),..., 
Am(X)) € Kes with the norm |A| defined by 


1 


= (x ar) : (3.2.2) 
isl 


N= 


IA] = (È awr) 
i=1 


where a;(x) 4—> aj € Zg: 
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Definition 3.2.1 Let 6 > 0 be a positive real number, n,m,q be positive inte- 
gers. The SIS problem on R, is defined as follows: for any given uniformly 
distributed vector A = (a)(x),...,@m(X)) € Ros find an m dimensional vector 
z = (zı (x), Z2(X),..-, Zm(X)) € Ry such that 


fal) = Dailxer(x) =0 
ae . (3.2.3) 
0 < |z| = (= oP) <£ 


i= 


This problem is denoted as R4 — SIS4,g,m- 


Remark 3.2.1 By the above definition, f4(z) € R4, so fa(z) = 0 is equivalent to 


faz) = XY aoza) = 0 (mod x” — 1), 


i=l 


here 0 < |z| < £ is computed in the real number field R. 


Remark 3.2.2 In order to guarantee the R, — SIS4,g,m problem has solution, we 
only need m > logyg, which has big difference from the requirement m > nlogg 
of the classical SIS problem (see Sect.2.2 in the last chapter). In fact, if A = 
(a, (x), d2(X),...,@m(X)) is given, the selection of z = (z1(X),..., Zm(x)) could 
be considered in Zy For each z;(x) <—> zi € Zp choose each coordinate of z; as 
0 or 1 so that the n dimensional vector z; has a short length. There are about 2” 
such short vectors z;, so there are about 2”” choices of z in total. If 2™” > q”, i.e. 
mn > nlogsg,m > logog, then z' € RY’, z" € RẸ => 


faz’) = fae") => fa’ — 2") = 0. 
So z = z’ — z” is the solution satisfying (3.2.3). 
Geometric definition of R, — SIS, g,m: 


Given m vectors A = (a1, æ, .. . , Am) uniformly distributed on Zi di € Li solve a 
group of nonzero short vectors z = (Z1, Z2,---; Zm), Zi € Eas such that 


fale) = Da; ®zj =0 


= (3.2.4) 
gaign, 1Si<n 


Obviously, R, — SIS problem is a special case of the knapsack problem on ring. 
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Definition 3.2.2 (Knapsack problem on ring) Let R be a commutative ring with 
identity, a1, . . . , am be m nonzero elements in R, X C R, |X| = 2”,b € R is called 
the target element. Knapsack problem on ring is to solve m elements z1, Z2,..-, Zm € 
X in X such that 


fa(2) = J aizi =b, Vz; € X. (3.2.5) 


i=1 


If R = Z is a ring of integers, X = {0, 1}, or X = {0, 1,..., 2” — 1}, then the 
above problem is the classical knapsack problem. It has been proved that the com- 
putational complexity of solving the knapsack problem on Z is subexponential, such 
as the super increasing sequence is polynomial. If R = R,, b = 0, then the above 
problem becomes the SIS problem on R,. The main result in this section is the fol- 
lowing theorem: 


Theorem 3.2.1 Let m = O(logn), k = O(log n), q È Amkn?, and y > 16mkn?, 
if we can solve the knapsack problem (3.2.6) on Rq, then there exists a probabilistic 
polynomial algorithm solving the covering radius problem CDP, for any n dimen- 
sional full rank cyclic lattice. 


The knapsack problem on R, in Theorem 3.2.1 is the more general case of (3.2.4), 
which is summarized in the following definition. 

Knapsack problem on R,: Choose m vectors A = (a1, a2, . . . , Gm) uniformly 
distributed on Z% randomly and any target vector b € Z% find a set of short vectors 
Z = (Z1, Z2,-++ 5 Zm) such that 


m 


fa) =) a ®z =b, |zil< Yn, 1<i<m. (3.2.6) 


i=l 


From Theorem 3.2.1, the knapsack problem on R, on the average case has a more 
difficult computational complexity than the covering radius problem on any full rank 
cyclic lattice under positive probability, which is another reduction principle from 
the worst case to the average case by Ajtai. 

The core idea of the proof of Theorem 3.2.1 is to approximate the covering radius 
p(L) of L by jo CS) for any cyclic lattice L = L(B) C R” under the assumption that 
(3.2.6) is solvable, where S = {s1, 52,..., Sn} C Lis a set of n linearly independent 


vectors, and 
1 


o(S) = (È sre) ; 


i=l 


{s], s3, ..., Sž} is the corresponding orthogonal basis of S using Gram-Schmidt 
algorithm. Since |s**| < |s;| (1 <i < n), we have 
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1 1 


a(S) = bs sre) < (Eee) i (3.2.7) 


i=1 i=1 


By Lemma 3.1.6, p(L) < $0(S). The core steps of approximating p(L) by ło (S) 
is summarized as follows. 


(1) Reduced algorithm 
Randomly choose S$ = {s1, 52,..., Sn} C L is a set of n linearly independent lattice 
vectors, assume that 
[S| = [sn] = max Isil. 
l<i<n 


If žo (S) < yp(L), then the CDP, problem on L is solved. If o (S) > 2yp(L), we 
can find a lattice vector s’ € L, such that 


Is] < ! [sn] l IS] 
sS =|sn| = =IS], 
ie 2 n 2 
and s1, 2, ...,S,—1, 5’ are linearly independent. Replace S with the new set of vectors 
S’ = {51, 82,..., 8,1, S’), that is, replace s, with s’ in S. Repeat this process n times 
and we can get 
1 
IS | < 5/SI- (3.2.8) 


Repeat the above reduced algorithm, and find a set of linearly independent vectors 
S C L, such that 

2y 
Jn 


and the computational complexity of the algorithm is polynomial. Based on (3.2.9), 
we have 
Jn 


1 n 
p(L) S 57) < a Sl < yp(L). 


[S| < p(L), (3.2.9) 


So we complete solving the CDP, problem. 


(2) Approximation of standard orthogonal basis 
Let {e0, €1,..., €n-1} C Zi be a standard orthogonal basis, L = L(B) C R” be a 
given cyclic lattice. Define the parameter 


4 
B= (“4 + *) a(S), (3.2.10) 
y 2 
where S = {51,52,...,S,} C L is a set of n linearly independent vectors, such that 


a(S) > 2yp(L). (33,11) 
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To find s’ in the reduced algorithm, by Lemma 3.1.6, there is a lattice vector c € L > 
1 
lc — Beol < 57 (8). (3.2.12) 
Since T is an orthogonal matrix, it is an orthogonal linear transformation in R”, i.e. 
|Ta| = jaj, Va € R”. 


Therefore, foranyO <k<n-—1, 
k 1 
|T"(c — Beo)| = |c — Leol < 579). 


Note that T*ep = eg, so 


1 
IT*c — Bex| < 509). 


Because c € L and L is a cyclic lattice, then T*c e L (0< k <n- 1). The circu- 
lant matrix T*(c) = [c, Tc,..., T*~!c] implements the approximation of standard 
orthogonal basis. 

In order to give a complete proof of theorem 3.2.1, we denote 


B' = q(T*(c))'B. (3.2.13) 


Lemma 3.2.1 The lattice L(B') generated by B' satisfies qZ” C L(B’). 


Proof By Lemma 3.1.5, since c € L and L is acyclic lattice, there exists an integer 
matrix D € Z”*" such that 


T*(c) = BD > B'T*(d) e Z”, 


thus, 
B'(B'T*(c)) = q(T*(c)) | - B - BIT* (©) = qh. 


Each column of the above matrix qe; (0< j <n- 1) e€ L(B’') > qZ" C 
L(B’). 

Based on Lemma 3.2.1, qZ” is an additive subgroup in L(B’). Randomly choose 
mk vectors X; e G(1<i<m,1K< j< k)inthe quotient group G = L(B’)/qZ", 
the integral vectors w, ; of x; ; 18 defined by 


1 


w; = [x] € Z”, l<i<m,1<j<k. 


Let i 
a = Xw; (mod q) > a; € Z}, (3.2.14) 


j=1 
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A = (a1, @, ..., Am) contains the above m vectors in Z”, consider the knapsack 
problem on R; = (Zi, +, 8), 


m 


fa) =) ai @ zi, Yz € Zp, |zil < Vn. 


i=1 


If we can solve the knapsack problem on R4, then f4(z) collision is also solvable. 
So there are integral vectors y = (y1, Y2, ---, Ym), Y = (V1, 92, -++5 Ym) Such that 


m 


fay — 3) = 0a Oi $i) =O, Vii < Va, Sil < Va, (8-2.15) 


i=1 


where 
Y = Y Y2 -- -> Ym) VS On J2, -- -> Pm). (3.2.16) 


Based on the vector clusters y and ĵ in Zp we define 


T*(0)x;; and w;j = TOW; 
k 
p= È Gi — wij) ® (Yi — Ji) 


i=1 j=1 


(32.17) 


The s’ defined by the above formula is just the s’ in the reduced algorithm. First, 
we prove the following lemma. 


Lemma 3.2.2 x;; € L(B) is a lattice vector in the given cyclic lattice L (1 < i < 
m,1 < j <k), andif fa(y) = fa (9), 8’ € L(B) is also a lattice vector. 


Proof Since a € L(B’), there is a € Z” such that Xj = B'a, we get 
1 * 1 1 * * -1 
ma Oam (c)-q(T*(c)) - Ba = Ba € L(B). 


To prove s’ € L(B), by (3.2.17) and the property of circulant matrix (see (3.1.5)) 


s= Xay 8 Oy — Îi) — > wij @ (Vij — Sis) 


= Pano = Fis) — DOT wi) Oi; — Ji) (3.2.18) 
m k o 


m k 
=Y rÈ ao- -Y TO w- 9). 
i=l j=l i=l j=l 


3.2 SIS and Knapsack Problem on Ring 67 


Based on the first conclusion, x;; € L(B) > Yo xij € L(B), since y; and 3; are 
integral vectors in Z”, it follows that 


k 
X xij (yi — fi) € L(B). 


Next we prove the second term of (3.2.18) is also a lattice vector. By the definition 
of Wij, 
k 


1 
wij = al (c)w;;, then X wij = ir (c) My 


j=l j=l 


> 


Hence, 


> 


k 


(2w = -ITOT Xw; 
j=j j=1 


The second term of (3.2.18) could be written as 


m 


ae 03 wisi — ĵi) = ir opr 03 w) Oi — $i) 
= a Bs 66 — ĵi). 


i=l j=l 


(3.2.19) 


Since 


m 


k 
X wiz Oi- 31) = D5 ai @ (Vi — Si) (mod q) = fa) — fa) (mod q), 


1 j=l i=l 


DF 


i 


by fa (y) = fa (9), we know the second term of (3.2.18) is in L(B), i.e. 


m 


Dor 3 wij) Oi — Si) € L(B). 


i=] 


Finally we have s’ € L(B) based on (3.2.18). 


Lemma 3.2.3 The lattice vector s' defined in (3.2.17) satisfies 


1 1 
f <S = n= A : 2.2) 
[s | zl | z5! (3.2.20) 
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Proof We only prove |s’| < a (S)/2,/n, since 


1 
n 


a(S) < a sie) < VnlS| = Valsnl, 
i=l 
we can get |s’| < 5|Sn |, and the lemma is proved. Based on the definition of s’, 
m k 
I< JOS Gy- wi) ® OF = SII. (3.2.21) 


i=1 j=l 


It follows that 
iin , i 1 , j 
Xij — wij = —T"(C) Qj; — Wij) = —¢ 8 yj — w;j). 
q q 
Let a = c — Beg, then |a| < ło (S) (see (3.2.12)), and 
1 , j 1_. 7 
Xij — Wij = —(a + beo) ® (Xj; = wi;) = —-T* (Œ + Benj; = w;;) 
q q 
Lo A ee D l 
= —pT* (e0)(x;; — wij) + -T* (@) (x; — wi) 
q q 
_ Boo , l px , , 
= Fas ae ee (a) (aj; — wij). 


Since 


1 
<S =n, 


; , 
|x ijl 7 


Ge w 
combine with (3.1.15) in the last section, we have (£ is determined by (3.2.10)) 


B >: , 1 , , 
lxi; — wijl < qt = w;;l + P (Xj; = w;;)| 


B 1 1 yn 1 
ge. 5 vn: 50(S) 
_B vm lg oS) vn 

q q 2 2 
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Based on (3.2.21), we get 


Is'| < mk/n max [Xjj — Wij aax Iy: — Jil 


o(S) 
NWA 


< mkxy/n - 2./n max |xij — wij| < 
ij 


So we complete the proof of Lemma 3.2.3. 


From the above lemma, the reduced algorithm required in Theorem 3.2.1 is proved. 


However, we must prove that {a;}/1, C Z} determined by (3.2.14) is uniformly dis- 


tributed, so that the knapsack problem on R, is solved in the average case. Next we 
prove that {a;}/"_, is almost uniformly distributed in Z}, that is, the statistical distance 
between the distribution of {a;} and the uniform distribution is sufficiently small. We 
first prove the following lemma. 


Lemma 3.2.4 Let B’ = q(T*(c))~'B, then the covering radius p(B’) of L(B') sat- 
isfies 


1 
B’ < D? 
p(B) 37 
where L(B) is a full rank cyclic lattice, c € L(B) is given by (3.2.12). 


Proof Based on the definition of covering radius, 
p(B’) = max |x — u,| = max |x — L(B’)|. 
xeR” xeR” 


Let ¢’ € R” be the vector achieving the maximum value above, i.e. |t/ — L(B’)| > 
p(B’), and 
It’ — B’z| > p(B), Vz € Z". 


Denote 
1 * f 
t= -T* (Qt. 
q 


Suppose Bzo € L(B) is the nearest lattice vector of t, then we have 
p(B) 2 dist(t, L(B)) = |t — Bzol 


1 * 1 1 * fi td 
= Pi (c)t' — Bzo| = ra (c)(t — B zo)| 


lc @d| (3.2.22) 
|d] 

lc @ d| 

min 

deR",d#0 |d| 


1 / f £ 
2 —|t — B zo| min 


> —p(B’) 


q 
1 
q 
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For any d € R”, d # 0, we estimate the value of c ® d. Since c = peo + œ, where 
læ] < $0(S), so 
lc @d| = |(Ben+ œ) @d| 


1 
> |d| — z Vno (S) 
APES 
=a Lo(s). 


By (3.2.22), we have (see (3.2.11)) 


1 
p(B) > > ToB). ZA a(S) 


> T 


This implies p(B’) < x. Lemma 3.2.4 holds. 


Lemma 3.2.5 Let A = L(B) be a lattice, Q C R” is convex and contains a ball 
with the radius r > p(A). Then the number of lattice vectors of L(B) contained in 


Q satisfies 


Vol(Q) p(A)n Vol(Q) 2p(A)n 
ao" 7 Vs BINS Fy ). 


Proof See Lyubashevsky and Micciancio (2006) or Lyubashevsky (2010). 
Based on the above lemma, let A = L(B’), we estimate the distribution of vectors 
{aij} in Zy From the definition 


aij = w;; (mod q), a; = Xaj (mod q), (3.2.23) 
j=1 


where Wij . is the ee vector of X;; , € G = L(B')/qZ". The ball taking Wij . as 
ve Senter with radius £ 2 is contained in ‘the cube centered as w,, j with the side Jength 
z: Since p(L(B’)) < E <5, from lemma 3.2.4, the number N of lattice vectors of 


LB ) in this cube satisfies 


1 1 1 1 
1--)<N< (+>). 
det(B’) 4 det(B’) 2 


is uniformly selected in L(B’)/qZ", there are 


1 
For any a € Ry = Zj, because x;; 


n 


q 


! nj—-l __ 
|L(B)/qZ"|~" = det(B) 
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possible choices, therefore, 


Pr{a;; = a} - —| < (3.2.24) 


2q" 


Now we estimate the probability distribution of {a;}""_,. 


Lemma 3.2.6 Let G be afinite Abel group, A,, Az, ..., Ay be k independent random 
variables on G, such that for any element x € G, 


1 1 
PHA, = x} = —| < —. 
|G| 2|G| 


Then the statistical distance between £ = ee ı Aj and the uniform distribution on 
G is 
AE, UG)) <2. 


Proof We use mathematical induction to prove that the following inequality holds 
for any positive integer k, 


Pr{é = x} xeEG. 


1 1 
<S ’ v. 
IGI] ` 2*|G| 


Ifk = 1, the inequality above holds. Assume it holds for k — 1, denote &’ = ye Ai, 
E = &' + Ag, we have 


1 ba ae ees 

Pag =x) - 2] = 2 Pelt =a, Ay = x —a} Tal 
= 2 = a}Pr{Ay = x — a} — a 
= (rte =a}— =) (Pra: =x-—a}— =) 

A IG] IG] 
1 1 1 
<È aiei 461 ~ FGT 
Thus, 
A(é, U(G)) = 39 Pr{é = x} l |< S l — 27 k+1) 
, 2 IGI] © 2 & X|G| ` 


xEG xeG 


This lemma holds. 
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From (3.2.23), (3.2.24) and Lemma 3.2.5, we know that each a; = 4 dij is 
almost uniformly distributed on Zi i.e. the statistical distance between a; and the 
uniform distribution is sufficiently small. Therefore, the knapsack problem on R, 
sampled by f4(z) is in the average case. So far, we have completed the proof of 
Theorem 3.2.1. 


3.3 LWE Problem 


The LWE problem is to solve a kind of random linear equations under a given 
probability distribution. To better understand the LWE problem, let’s start with the 
checking learning problem (LPE) with errors. Let Z = {0, 1} be a finite field with 2 
elements,n > lande > 0 bea given parameter. The distribution of £ with parameter 
€ on Zp is 

Pr{é = 0} = 1 — e, Pr{&é = 1} =e. 


If a, b € Zp, the probability that a and b having the same parity is 1 — e, i.e. 
Pr{a = b (mod 2)} = 1 — e, 


denoted as a =, b. The checking learning problem with errors LPE is: given m 

independent vectors {a1, a2, . . . , Am}, a; € Z3 uniformly distributed on Z5, and b = 
by 

€ Z7, to solve a vector s € Z3, such that the following m random congruence 


bm 
equations hold simultaneously 


bi =< aj,5 > (mod 2) 


by =;< a2, 5 > (mod 2) 
: , (3.3.1) 


bm =e< am, S > (mod 2) 


where < a;, s > is the inner product of two vectors in Z3. If e = 0, then the dis- 
tribution £ becomes the trivial distribution, and (3.3.1) becomes m deterministic 
congruence equations. At this time, the LPE problem could be solved by Gauss 
elimination method with only n equations, and the computational complexity is a 
polynomial of n. If e > 0, the LPE problem is nontrivial, and its computational 
complexity is exponential of n. For example, the likelihood algorithm requires O (n) 
random congruence equations with computational complexity 22). In 2003, Blum 
et al. (2003) proposed a subexponential algorithm whose computational complexity 
and the number of random congruence equations are both 22/8"), which is the 
best result of the LPE question so far. 
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Generalizing the LPE problem from mod 2 to the general case mod q, it becomes 
the LWE problem. Due to the important role of the LWE problem in modern anti- 
quantum computing cryptosystems, we will introduce the related concepts and results 
in detail in this section. First, we define the random congruence equation with error 
on the integer ring Z. Let n > 1, q > 2 be two positive integers, Z4 be the residue 
class ring of mod q, and x be a probability distribution on Z4. 


Definition 3.3.1 Leta, b € Z, e € Z4, if 
Pr{a = b +e (mod q)} = x (e), (3.3.2) 
we call a and b are congruential mod q under the distribution x, denoted as 
a =, b +e (modq), ora =, b+ e. (3.3.3) 


The above formula is called a random congruence equation with error under x, and 
it is abbreviated as a = b + e sometimes. 


Based on the above random congruence equation, we give the definition of the 
LWE distribution A, ,. 


Definition 3.3.2 Lets € Zp x be a given distribution on Z4, the LWE distribution 

As, = (a,b) € Zi x Zq generated by s and x satisfies: 

(1) ae Zi is uniformly distributed; 

(2) b=,<a,s > +e, where < a, s > is the inner product of a ands in Z,,e € Z, 
has the distribution x, i.e. e < x. We call As, = (a, b) € Zi x Zq the LWE 
distribution, s is called the private key and e is called the error distribution. If 
b € Z, is uniformly distributed, then A, , is called the uniform LWE distribution. 


Under the LWE distribution A, , = (a, b) € Zi x Zq, for a given error e € Z4, 
the essence of finding the private key s = (S1, 52,..., Sn) € Zi is solving the random 
knapsack problem on the ring Z4: 


b = ası + A282 +--+ + ansSn (mod q), 


solve s € Zi under the probability distribution x (e). Next, we give the definition of 
LWE problem LWE, ,4,x,m with the parameters n > 1,g > 2,m > land x. 


Definition 3.3.3 For any m independent samples (a;i, bj) € Zi x Za A <i <m) 
ei 
of As, y, and randomly selected samples of the error distribution e = | : |, e; € 


em 
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Zq» ei <— X, the LWE,,4,x,m problem is to solve the private key s € Zi with high 
probability (larger than 1 — ô). In other words, solve s € Z% satisfying 


by =< 4,8 > +e, 
bz =, < 4,5 > +e2 


(3.3.4) 


bm =; < Am, S > +€m 


Remark 3.3.1 If x is the trivial distribution, i.e. x (0) = 1, x(k) = 0 forr 1 <k < q, 
0 


then the samples of x are e = | : |, (3.4) becomes m deterministic congruence 


0 
equations 
bı =< a;,s > (mod q) 
by =< a, s > (mod q) 


Din =< am , sS > (mod q) 
Based on the Gauss elimination, we can calculate the only private key s € Z} from 


n congruence equations, and the computational complexity is polynomial. 


Remark 3.3.2 Let g = 2, x be the two point distribution with parameter ¢ on Z3, 
then the LWE problem on Z, is just the LPE problem. For any error distribution 


ei 
e= | : |, ife; = 1, from 
em 
Pr{b; =< a;,s > +1 (mod 2)} = €, 
we can get 


Pr{b; =< a;,s > (mod 2)} = 1 — e. 


Matrix representation of the LWE,,4,,, problem 


Let A = [a1, @2, .. . , amlnxm € Zy” be a random matrix uniformly distributed, b = 
by el 
by e 
E€ Z> e=|. |€ Zg be the errors, and e <— x”, solve the private key 
bm em 


SE Zp such that 
b =, A's + e (mod q), (3.3.5) 


where A’ is the transpose matrix of A, and (3.3.5) is a set of random congruence 
equations with errors. The probability that the ith congruence equation holds is 
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Pr{b =, A's + e (mod q)} = 72, x (ei) = x (e). (3.3.6) 


Let A, (A) and Az (A) be q ary integral lattices (see Sect. 7.3 of Chap. 7 in Zheng 
(2022)), defined by: 


| A4 (A) = {A'x | x € Zi} + qZ} (3.3.7) 


AŁ(A) = {x € Z" | Ax = 0 (mod q)} ` 


Since A4 (A) = qA} (A)*, A's € A, (A), the geometric meaning of LWE, ,4,x,m is to 
solve a lattice vector A’s near from b for any b € Z> such that the distance b — A’s 
has the distribution x”, which is dual to the SIS problem. 


Lemma 3.3.1 Suppose A € Z" is a random matrix uniformly distributed, A = 
[A,, A2], where A, € a is an invertible matrix, let A = A;'A =([h, Ay Aol, 
then A, , and A, , have the same probability distribution. 


Proof From Lemma 2.1.1 in Chap. 2, if A is uniformly distributed, then A is also a 


1 el 


uniform random matrix. Assume b = ,e= (: ). SE Zi satisfy 
2 


b =, A's +e (mod q), 
that is, 


by =, Ais +e; (mod q) 
by =, As + e2 (mod q) ` 


= _ (Ath \ ._ [Ate 
B= (Ain) e= (Aho i 


Obviously, b and b have the same probability distribution, so are Z and e, 


Let A* = (A,)~!, and 


b=, Aj c) (mod q) =, A{ (A's + e) (mod q) 


=, AjA’s + Aje (mod q) =, A's + e (mod q). 


The lemma holds. 


The above A = [I;, Ay Aol is called the normal form of the LWE problem. 


Lemma 3.3.2 Let x, y, z be three random variables on Z4, x and y are independent, 
z =x + y (mod q). If x is uniformly distributed on Z4, so is z. 
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Proof For any integer 0 < i < q — 1, we compute the probability that z takes the 


value i. 
q-1 


Priz =i} =) Pr{x=j,y=i- j} 
j=0 
q-1 
= Prix = sPriy =i-j} 
j=0 


1 


q-1 
=—) 0 Priy=i-jl= 
j=0 


1 
a2 ; 


q 


Lemma 3.3.3 In the LWE distribution As, = (a, b), b is uniformly distributed if 
and only ifb— < a, s > is uniformly distributed. 


Proof Ifb— < a, s >is uniformly distributed, from b = (b— < a, s >)+ < a, s > 
and Lemma 3.3.2, we get b is uniform. On the other hand, if b is uniform, from b— < 
a,s >= b+ (— <a,s >) and Lemma 3.3.2 again, b— < a, s > is also uniformly 
distributed. 


According to Definition 3.3.1, the above lemma gives an equivalent condition that 
As, is a uniform LWE distribution. An equivalent form of the LWE problem is the 
decision LWE problem, which we call the D-LWE problem. 


Definition 3.3.4 (D-LWE problem) Given a € Z% is uniformly distributed, s € Z% 
e € Z, with the distribution x , decide whether < a, s > +e is uniform under positive 
probability of s. 

The D-LWE problem seems easy, however, the difficulty of it is equivalent to that 
of the LWE problem. We will prove this equivalence in detail in Sect. 3.4. Here we 
focus on the probability distribution x of the LWE problem. Usually, x takes the 
discrete Gauss distribution on Z4. In Chapter 1, we discussed the discretization of 
continuous random variable with Gauss distribution in R” on lattice in detail. The 
discrete Gauss distribution on Z, is actually the discretization of Gauss distribution 
on Z4. 


Recall the definition of Gauss function p,(x) in Chap. | (see (3.2.1), 
ps(x) =e BP x ER", (3.3.8) 
Ifn = 1, p,(x) is a density function of continuous random variable on R. We convert 


the corresponding random variable of p;(x) to mod 1, which becomes a continuous 
random variable defined on T = [0, 1) (mod 1) of length 1, with the density function 
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+00 
Larga 
ww= > a POW yeT. (3.3.9) 


k=—00 


It is easy to see that 


1 
1 
foa = f wax = | god = 1. 
T 0 R 


In order to estimate the statistical distance between random variables defined by 
different £, we first prove the following two lemmas. 


Lemma 3.3.4 Lett and l be positive real numbers, x, y € R” satisfy 
Ix] <t, and|x — y| <S l. 


Then 
T 2 
oO) > (1 -FOI )) D (3.3.10) 


Proof For any z € R, we have 
e*>1-z,zeER. 


Therefore, 


Zay ake ee 
Ps) =e RAM >e 3 (lx|+y—x]) 


eT ZP+) 


W 


ew ZU HH) 


W 


> (1 - SQ + Po). 
S 


Lemma 3.3.5 Let 0 <a < B < 2a, then the statistical distance between Y and 
We satisfies 


— 1). (3.3.11) 


RID 


9 
A(Va, Wg) S z. 
Proof Based on 


1 
f vocoar = 1. 
0 


it follows that 
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1 
J ne ales 
0 


dx 
k=—0o 
1 
+00 
l -zjx l _ xy 2 
= [|e pl pine dx 
a 
k=—oœ 6 
+00 
1 -Z 2 1 ajs 
= —¢ FH ZANT dx. 
B a 


Let x = ay, we get 


+00 


1 
| a(x) — Walx)ldx < f ra ttl dy, (3.3.12) 
0 —oo 


Without loss of generality, assume œ = 1, 8 = 1 + £, where O < e < 1, we estimate 
the right hand of (3.3.12) 


Pe 1 —— jx]? 
f eTl — —— e avez 
l+e 
R 


2 ——2 jx]? 1 ——_* |x]? 
< ehh _ eae jax + f 1— e TP dy 
<J ( E 

R 


dx 


=r |x]? 


-——45 |x? 
e —e tHe) dx +e 


m(1 


1 Jx? x x2 
l—e (+e)? -e d+?" dx te, 


R 
R 
R 

For Vz > 0, we have 


and 1 
1 2 
oo ee | <ra- r? 
(l+e)? 


= ame + &7)x? < Qn ex?. 
€ 
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Finally, 


1 
J IVa (x) — p(a)|dx < ane | xe TR dx +e = e+ e(l +e)? < 9e. 
0 R 


Since £ = Ê — 1, based on (3.3.12), 


— 1). 


R|D 


E 9 
A(Wa, Wp) = Al IWa(x) — Wp(x)idx < z. 


We complete the proof of this lemma. 


In order to obtain the discrete Gauss distribution on Z4, we construct a discrete 
processing technique for continuous random variables. Let T be any interval with 
length 1 on R, denoted as 

T = [0, 1) (mod 1). 


If p(x) is the density function of a continuous random variable g on T, we define 
a discrete random variable @ on Z, by 


ọ = lael. (3.3.13) 


that is, if g takes a value x € T, then @ takes the value |qx] mod q, where |x] 
is the closest integer to x. When x runs over [0, 1), obviously |qx] runs over Z,, 
so @ defined in (3.3.13) is indeed a discrete random variable on Z,. We call @ the 
discretization of g. 


Lemma 3.3.6 If ọ is a continuous random variable on T with the density function 
y(x), then @ is a discrete random variable on Z4, and its probability distribution 


o (k) is 
(k+3)/4 


Pr{ọ = k} = G(k) = / g(x)dx, k € Z4. 
k- 4)/4 
Proof 
1 1 


(k+4)/4 


=P k : < k : = d. 
= r{( -5)ia<e<( +5) /4} = I p(x)dx. 


(k—4)/q 
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Definition 3.3.5 The discrete Gauss distribution Ve on Zg is defined by 


(k+5)/q 
Yek) = f Yyg(x)dx, (3.3.14) 


(k-5)/4 


where g(x) is the continuous Gauss distribution on T in (3.3.9) and £ is called the 
parameter of discrete Gauss distribution. 


In the LWE problem, usually we suppose x = Ve is a discrete Gauss distribution. 
The main result in this chapter is the following theorem. 


Theorem 3.3.1 Let m = Poly(n), q < 2°"™, x = Wy be the discrete Gauss dis- 
tribution with parameter a, where 0 < a < 1, and aq > 2./n. Then the difficulty of 
solving the D-LWEy q,x,m problem is at least as hard as that of GapSVP,, or SIVP, 
problem on any n dimensional full rank lattice L based on quantum algorithm, where 
y = O(3). 

The proof of Theorem 3.3.1 will be given in the next section. Here we only introduce 
the idea of this proof. The proof of Theorem 3.3.1 is mainly divided into the following 
two steps: 


(1) Using the quantum reduction algorithm to prove that the LWE, q,x,m problem 
is as least as hard as difficult problems on any lattice such as the GapSVP and 
SIVP problems. 

Prove the difficulty of the D-LWE,, q,y,m problem is not lower than that of the 
LWE, q,x,m problem (see Theorem 3.4.1 in the next section). The original proof 
the Theorem 3.4.1 is based on the modulus q being a prime number, such as 
q = 2. Later it is generalized to the general case q = 2°") (see Regev (2009) 
and Peikert (2009)), and the proof of Theorem 3.3.1 is complete. 


(2 


YS 


3.4 Proof of the Main Theorem 


In this section, we mainly prove that the difficulty of solving D-LWE problem is not 
lower than that of the hard problem on lattice, that is, if there is a quantum algorithm 
for solving the D-LWE problem, then there exists a quantum algorithm to solve the 
hard problem on lattice. The whole proof could be divided into three parts. In order 
to better understand the three parts of proof, we first introduce the definition of the 
DGS problem. 
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= aa l lemma 4.5 
x | lemma 4.4 | to 
LWE to DGS — 
[lemma 4,3 f 3 A , 
4 14 : lemma 4.1 2 
emma. m |lemma4,.13 
theorem 2 ; llemma4.1 5 
llemma4,1 7 m 
llemma4.1 6 
DGStoGIVP = 
| theorem 3 
D-LWE to LWE 


Fig. 3.1 The flowchart of the proof of Theorem 3.3.1 


Definition 3.4.1 DGS,: given an n dimensional lattice L with generated matrix B, 
a real number r > $(B), where ¢ is a real function of B. The goal is to output a 
sample from the discrete Gauss distribution Dy. 


The DGS problem is also called the discrete Gauss sampling problem. We will 
see that the difficulty of the DGS problem is polynomial equivalent to that of the hard 
problem on lattice after this proof. Next we introduce the idea of proving that the 
D-LWE problem is at least as difficult as the hard problem on lattice. This proof could 
be divided into three parts, which are given in Sects. 3.4.1, 3.4.2 and 3.4.3. In Sect. 
3.4.1, we prove that if there is a quantum algorithm to solve the LWE problem, then 
there is also a quantum algorithm to solve the DGS J, (7) problem. In Sect. 3.4.2, 
we give a reduction algorithm from the GIVP mọ problem to the DGSg problem, 
so that we have completed the proof that the LWE problem is not less difficult than 
the hard problem on lattice. In Sect. 3.4.3, we further prove that the D-LWE problem 
D-LWE, ,4,x,m can be reduced to the LWE, 4, ,,m problem and complete the proof of 
Theorem 3.3.1. The flowchart of the whole proof is shown in Fig. 3.1. 


3.4.1 From LWE to DGS 


In this subsection, we will solve the DGS 7, (7)/q problem by the algorithm of 
LWE, ,q,ya,m problem. The main conclusion is the following Lemma 3.4.1 , and its 
proof depends on Lemmas 3.4.2 and 3.4.3. We give these three lemmas first. 
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Lemma 3.4.1 Let m = Poly(n), ¢ = e(n) be a negligible function of n, q = q(n) 
be a positive integer, a = a(n) € (0, 1), ag > 2./n, x = Ya. Assume that we have 
an algorithm W that solves the LWE,,4,v,,,m problem given a polynomial number 
of samples, then there exists an efficient quantum algorithm for the DGS in, (Lja 
problem. 


Lemma 3.4.2 For any n dimensional lattice L and a real number r > 2?"1,(L), 
there exists an efficient algorithm that outputs a sample from a distribution that is 
within statistical distance 2-2 of the discrete Gauss distribution Dy, where Q (n) 
is a polynomial function or exponential function of n. 


Lemma 3.4.3 Let m = Poly(n), € = e(n) be a negligible function ofn, q = q(n) > 
2 be a positive integer, a = a(n) € (0, 1). Assume that we have an algorithm W 
that solves the LWE, 4,y,,m problem given a polynomial number of samples, then 
there exists a constant c > 0 and an efficient quantum algorithm that, given any 
n dimensional lattice L, a real number r > V2qn¢(L) and n° samples from DL, 
outputs a sample from Dy, jj(aq)- 


Proof of Lemma 3.4.1: Given an n dimensional lattice L and a real number r > 
V2nn-(L)/a, our goal is to output a sample from the discrete Gauss distribution 
Dz.. The idea of this proof is to use iteration steps. Let 


ri =r(aq/ vn}, i=1,2,...,3n. 
Based on Lemma 1.3.6 in Chap. 1, 


ln 1/e àn (L) 


T n 


ran > 2”r > 2” 21nn; (L)/æ > 2” 2n > 2” An (L). 

By Lemma 3.4.2, we can produce samples from the discrete Gauss distribution Dz ,,, . 
Suppose c is the constant from Lemma 3.4.3, we output n° samples from Dy ,,,. 
According to Lemma 3.4.3, we can get samples from the distribution Dz... i/(aq)> 
i.e. Dz,,,_,- Repeat this process, since 


rı =rag/Jn > V2nne(L)/a-aq//n = V2qne(L), 


which satisfies the condition of Lemma 3.4.3, finally we can output a sample from 
Dy», fnj(aq) = DL,- The lemma holds. 


Proof of Lemma 3.4.2: By the LLL algorithm (Lenstra et al. (1982)), we can choose 
the generated matrix B = [b1, bo,..., bn] of L satisfying b; < 2”2,(L), 1 <i <n. 
Suppose F (B) is the basic neighborhood of lattice L. The algorithm in Lemma 3.4.2 
can be achieved by the following steps. First we generate a sample y from the discrete 
Gauss distribution D,, where 


r(x) 


r” 


D, (x) = , Vx e R”. 
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We get y’ = y mod L € F(B), and x = y — y’ € L. Denote the distribution of x as 
€E, next we prove the statistical distance between £ and Dz, is exponentially small. 
Note that 


ly'| < diam(F(B)) < È` Ibi] < n2"A,(L), 
i=1 


where 
diam(F(B)) = max{|u — v| | u, v € F(B)}. 


Based on Lemma 1.3.4 in Chap. 1, 
p(L\JarN) < (rv 2xee*")"p(L), 


here N is the unit ball. This means p(L\./nrN) is exponentially small, so we can 
always assume x < ./nr. By Lemma 3.3.4, let t = ./nr, l = n2"A,(L), by some 
simple calculations we get 


Pr{é = x) = f D, (y)dy > f (1 — 272%) D, (x)dy 
x+F(B) x+F(B) 
= (1 — 2-2) D, (x)det(L). 


On the other hand, from Lemma 1.3.2 in Chap. 1, 


pr (x) _ Pr (x) $ pr (x) 


Pr{Di, = x} = = < 
i Pr(L)  det(L*)r” pij (L*) ` det(L*)r" 


= D,(x)det(L). 


So we have 
Pr(é = x} > (1 = 272 ™)Pr{ Dr, = x}. 


Summing x € L on both sides, we get the statistical distance between € and Dz, is 
exponentially small. The lemma holds. 


Definition 3.4.2 (1) CVP; a: given ann dimensional lattice L, a target vectort € R”, 
a real number d, dist(t, L) < d, find u € L such that 


ju—t|= min |x—-tl. 
xeEL,|x—t|<d 


(2) CVP: given an n dimensional lattice L with generated matrix B, a tar- 


get vector t € R”, a real number d, dist(t, L) < d, denote Kz (t) = {u € L | |u — 
t| = min |x — t|}, i.e. Kz (t) is the closest vector to f in the lattice L, output 
xEL 


—1 3 n 
B~ K;(t) mod q € Z4- 
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The CVP problem is also called the closest vector problem. In order to prove 
Lemma 3.4.3, we need the following two lemmas, Lemmas 3.4.4 and 3.4.14. In 
Lemma 3.4.4, we use the samples of Dz,, to solve the CVP}. 44/3) problem, and 
Lemma 3.4.14 shows that we can generate a sample of Dz» j/aq from the algorithm 
of solving the CVP} «44 /(,/3,) Problem so that we complete the proof of Lemma 3.4.3. 
The following content is divided into two parts. In the first part, we use Lemmas 3.4.5 
to 3.4.11 to prove Lemma 3.4.4, which is to solve the CVP} y4/(./3,) problem based 
on the samples of Dz „. In the second part, we prove Lemma 3.4.14 according to 
Lemmas 3.4.12 and 3.4.13, and achieve the transition from solving CVP% 44 /(/3;) 


to Di + Jajag: 


Lemma 3.4.4 Letm = Poly(n), € = e(n) be a negligible function ofn, q = q(n) > 
2 be a positive integer, a = a(n) € (0, 1). Assume that we have an algorithm W 
that solves LWE),q,y,,,m given a polynomial number of samples, then there exists a 
constant c > 0 and an efficient algorithm that, given any n dimensional lattice L, 
a real number r > /2qn,-(L), and n° samples from Dz r, solves the CVP is «aq /(V2r) 
problem. 


Proof This lemma is proved directly by the following Lemmas 3.4.5 to 3.4.11. 


Lemma 3.4.5 shows the relationship of difficulty between the CVP and CVP 
problems. 


Lemma 3.4.5 Given ann dimensional lattice L, arealnumberd < h,(L)/2,q > 2 
is a positive integer. There exists an efficient algorithm to solve the CVP;z a problem 
based on the algorithm for CVP? 


Proof Let x € R” satisfying dist(x, L) < d be the target vector, define vectors {xn} 
and {a,} as follows: xı = x, 


ai = B Ki (xi) € Z", i > 1, 
which is the coefficient vector of the closest vector to x; in lattice L, 
Xi+ı = (x; — B(a; mod q))/q, i 2 1, 


it is easy to prove 
ai+ı = (a; — (a; mod q))/q, 


and 


|a 


Ixi41 — Bai+ı| < 


z 


LQ 


That is, the distance from x,,4; to lattice L is no more than a Note that a could be 
sufficiently small if n becomes lager enough. Based on the nearest plane algorithm 
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by Babai (1985), we can find y € L such that y is the closest vector to x„+1 in lattice 
L. Let y = Ba, then an+ı = a, combine with 


di+1 = (a; — (a; mod g))/q, 


we get an, dn—1,..., 41, and complete the process of solving the CVP; 4 problem. 
This lemma holds. 


We introduce the definition of the LWE distribution A, , in Definition 3.3.2, where 
x is a distribution on Z,. If the value space of x is changed to T = [0, 1), we can 
give another definition of LWE distribution. 


Definition 3.4.3 Lets € Zp e be a random variable on T with density function œ. 
The LWE distribution A, 4 = (a, b) € Zi x T generated by s and ¢ satisfies: 
(jae Zi is uniformly distributed. 
(2)b=a-s/q+emod 1. 


The LWE distribution we discuss later in this section is always Ay. 


Lemma 3.4.6 Let q = q(n) > 1 be a positive integer, given s' € Z} and samples 
from As, y, for some unknown s € Zi, a < 1. There exists an efficient algorithm that 
determines whether s' = s with probability exponentially close to 1. 


Proof Let (a, x) be a sample from the LWE distribution A; y,, T = [0, 1), € be a 
random variable on T with density function p(y) such that 


E=x-a-s'/q=e=eta-:-(s—s’)/q. (3.4.1) 


The steps of the algorithm are as follows. Generate n samples y1, yo,..., Yn of E and 
compute 


1~ 
== cos(27ry;). 
z 22 (2ryi) 


If z > 0.02, then we confirm s = s’, otherwise, we decide s Æ s’. Next we prove the 
correctness of this algorithm. 

Ifs = s', by (3.4.1) we geté = e with the distribution Yg. On the other hand, ifs # 
s', then there is 1 < j < n, such that sj A 8, where s; and S; are the jth coordinates 
of s and s’ , respectively. Let g = gecd(q, sj — s), k = q/gcd(q, sj — s), aj be 
the jth coordinate of a, it is not hard to see the distribution of a; (sj — s;) mod q 
has period g, i.e. the distribution of aj;(s; — s;)/q mod 1 has period g/g = 1/k, 
k > 2. Since & is regarded as the sum of a;(s; — s) /q mod | and an independent 
random variable, therefore, the distribution of £ also has period 1/k. Assume Z is 
the expectation of cos(27ré), 
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1 1 


2 = Elcos(27é)] = 1 cos(2xy)p(y)dy = Re f 2" p(y)dy. 
0 0 


When s = s’, the distribution of £ is Wy, the right hand of the above formula could 
be computed as z = e77% When s Æ s’, the distribution of £ is periodic with period 
1/k, note that the integral of the periodic function e?*"” p(y) with period 1 is fixed 
in any interval of length 1, then 


1 I+; 


J e? p(y)dy = / e**"” p(y)dy 
: i 
1 


I eo p(y)dy 


© 


1 
=er J e""" p(y)dy. 
0 


From k > 2 we know Z = 0, by the Chebyshev inequality, 


B Var[cos(27€)] 


Pr{lz—2| < 0.01} > 1 
nee! 0.012n 


The probability of |z — Z| < 0.01 is exponentially close to 1 when n is large enough. 
Thus, we confirm s Æ s’ with probability exponentially close to 1 if z < 0.02. We 
complete the proof. 


Based on Lemma 3.4.6 and the algorithm for LWE,,4,y,,,m, for any f <a and 
samples from As,yș, the following Lemma 3.4.7 gives an algorithm to solve s with 
probability close to 1. 


Lemma 3.4.7 Let q = q(n) > 2 be a positive integer, a = a(n) € (0, 1). Assume 
that we have an algorithm W that solves LWE, q,y,,,m with a polynomial number 
of samples, then there exists an efficient algorithm W' to solve s with probability 
exponentially close to 1 for some samples from As y,, where B < a and p is unknown. 


Proof Assume we need n° samples in the algorithm W, c > 0 is a constant. Let the 
set Z be 
Z = {y | y = ôn ™ a’ € [0, a°], 5 € Z}. 


The steps of algorithm W’ are as follows. For each y € Z, we repeat the following 
process n times. Each time we get n° samples from As, y, and add samples from 
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Ww yy to the second component of each sample from A; y,, 80 we obtain n° samples 
from As, y JAF We solve s’ by algorithm W and determine whether s’ = s. If s' = s, 
Y 


output s’ and we complete the algorithm. Next we prove that the above algorithm 
could achieve the goal of solving s with probability exponentially close to 1. Assume 


T = min{y € Z, y > a2 — p’). 
From the definition of the set Z 
r <a? p? +n’, 
Let a’ = y8? +T, we have 
asa’ < Va? +n a? < (1+n™)a. 


Based on lemma 3.3.5, 
9 d 9 
A a> w) S= =l Sna 
mae Eje 


Therefore, the statistical distance between the n° samples from Yg and n° samples 
from Wy is no more than 9n~°, which means the probability that the algorithm 
W solves s successfully is at least 1 — 9n~° > 5. It follows that the probability of 
solving s unsuccessfully n times is no more than 2~”. The lemma holds. 


To prove our main result, we need two properties about the Gauss function and 
statistical distance. 


Lemma 3.4.8 For any n dimensional lattice L, c € R”, € > 0, r > ne(L), we have 


p (L +c) € r"det(L*)(1 + 8). (3.4.2) 


Proof Based on Lemma 1.3.2 in Chap. 1, 


pL +o) = >> pr) = det(L*) X ôO) 


xeL yeL* 


= r"det(L*) DY) pir) 
yeL* 


=r"det(L*)(1 + > MY oj). 
yeL*\{0} 


From r > n,(L), it follows that ;/,(L*\{0}) < £, and 
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>. ei o) < +e Pir) SE. 


yeL*\{0} yeL*\{0} 


We get 


p (L +c) =r"det(L*) | 1+ = ei ny, (y) | € r"det(L*)(1 £6). 
yeL*\{0} 


The proof is complete. 


Lemma 3.4.9 For any n dimensional lattice L, u € R", € < 4, r, s are two positive 


real numbers, t = Jr? + s*, assume rs /t = 1//1/r? + 1/s? > n-(L), let be the 


sum of a discrete Gauss distribution D,+,,- and a noise distribution D,, then 
A(&, D,) < 2e. (3.4.3) 


Proof Let the density function of £ be Y (x), then 


1 


Yœ = ———_ } omea- y) 
R pr(L + u) yeL+u 
= ET 5 exp | —z | | + 
S p: (L SE u) yeL+u r S 
1 r2 + s2 r2 2 1 i 
= ex T + 
s"p,(L +u) 2 j ( ( ne V pga "pao" 


ex £ | le : 
= x 
a + 52 s"p,(L +u) 


y Xx 
2 o2 2 2 
yeL+u fa rors 
Pt (x) Prs/t,(r/t)2x—u (L) 
s” Pr,—u(L) 


_ A(x) Prs/t,(r/t)2x—u(L*) 

OO Âr”) 

P) (t/15)" Prsjt(r/t)2x—u(L”) 
t” A/F)” Êru (L) 


(3.4.4) 
Based on the Fourier transform property of Gauss function in Lemma 1.2.1 in Chap. 
1, we get 


Prajtte fea (w) = exp(—27 i ((r/t)?x —u)- w)(rs/t)" Pirs (w), 
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and 
bru (Ww) = exp(2miu - w)r" pıyr (w). 


Since r > = > ne(L), 
[1 — (t/r5)" Ôrsjt,e/ġ2x-u (L| < Pr/rs(L*\{0}) < €, 
[1 — (1/r)" Êr -u (L*)| < P1 (L*\{0}) < €. 
It follows that 


1— Bre Bso alL 1 
E c rS)" Prsjr e ( dg FE cpa, 
-E 


l— 2e < < z 
lFe (1/r)" r -u (L*) 


By (3.4.4), 


ro- 2D) «4p, 


Integrate for x € R”, 


ag. d=; f rœ- Phar < 2. 


R” 


We complete the proof. 


Lemma 3.4.10 For any n dimensional lattice L, vectors z, u € R”, real numbers 
r,a >0, £< 5, ne(L) < 1/V1/r? + (|z|/a)2, let v be a random variable of the 
discrete Gauss distribution DL+u,r, e be a random variable of Gauss distribution 
with mean 0 and standard deviation a//2n, £ be a random variable of Gauss 
distribution with mean 0 and standard deviation vrizh? + at? / v27, then 


A(z- v +e, E) < 2e. (3.4.5) 
In particular, 
A(z-v+e mod L, V (epee) < 2e. (3.4.6) 


Proof Let the random variable h has distribution D,/z;, then the standard deviation 
of h is æ/(|z|v/27), and the standard deviation of z - h is |z| - œ/ (|z| V27) = a//20 
which is the same as that of e. Since both of them have Gauss distributions, we get 
the distributions of z - h and e are the same, i.e. z - v + e and z - (v + h) have the 
same distribution. Based on Lemma 3.4.9, let s = œ /|z|, it follows that the statistical 


distance between v + h and D RETE is no more than 2e, 


AW+h, D faram < 2e. 
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By the property of statistical distance, 


AG: WU+h),2-D pai S? 


Here the standard deviation of z - D Fale? is 


Izl Vr? + (ae/lzlP/V 2x = V (rll)? + 02/V 2x, 


which is the same as that of £. Note that both of the two random variables have Gauss 


distributions; therefore, z - D alley? and é have the same distribution, i.e. 


A(z-u+e,&) < 2, 


mod 1 for both of the two random variables, 


AG@-u+emodl,W pyra) < 26. 


The lemma holds. 


Lemma 3.4.11 Let ¢ = e(n) be a negligible function of n, q = q(n) > 2 be a pos- 
itive integer, a = a(n) € (0, 1). Assume we have an algorithm W to solve s given 
a polynomial number of samples from As y, for any P < a (B is unknown), then 
there exists an efficient algorithm that given an n dimensional lattice L, a real num- 
ber r > /2qn-(L) and a polynomial number of samples from Dz., to solve the 


(q 
CVE e aA problem. 


Proof For a given x € R”, dist(x, L*) < æq /(v2r), denote the generated matrix 
of L is B, and the generated matrix of L* is (B’)~', our goal is to solve s = 
BT K,«(x) mod q. The idea of algorithm W’ is to generate a polynomial number 
of samples from A;_y,, and solve s according to the algorithm W. 

The steps of algorithm W’ are as follows: let v € L be a sample from the discrete 
Gauss distribution Dz ,,a = B~'v mod q, e be random variable of Gauss distribution 
with mean 0 and standard deviation aw/(2,/7), then there is 8 < «œ such that the 
statistical distance between (a, x - v/q + e mod 1) and As,y, is negligible. Next we 
prove the correctness of this algorithm. 

Firstly, note that the distribution of a is almost uniform, i.e. the statistical distance 
between a and the uniform distribution is negligible. This is because for any ay € Z”, 
we have 

Pr{a = ao} = p, (qL + Bao) = prjqg(L + Bao/q). 


Since qne(L) < r, based on Lemma 3.4.8, 


Pr{a = ao} = p,a (L + Bao/q) € (r/q)"det(L*)(1 £), Vag € Z”. 
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This implies a is almost uniformly distributed. 
Secondly, we consider the distribution of x - v/g + emod1.Letx’ = x — Kr (x), 
from dist(x, L*) < ag/(/2r) we get |x'| < aq/(V/2r) and 


x-v/q+emod 1 = (x'/q)-v+e+ Ki«(x)-v/q mod 1. (3.4.7) 
We compute the distributions of Kz» (x) - v/q mod 1 and (x’/q) - v + e, respectively. 
It is easy to see 
Kr: (Œ) 0 = (BY Ky +(x) - (B™'v), 
therefore, 
K(x) - v mod q = (B7 K;+(x))- (B~!v) mod q = s - a mod q. 
This means Kz» (x) - v/q mod 1 ands - a/q mod 1 have the same distribution. In order 


to get the distribution of (x'/q) - v + e, note that v has discrete Gauss distribution 
D4L+Ba,r, and e has Gauss distribution with mean 0 and standard deviation œ / (24/7), 


let B = J/(r|x’|/q)? + &?/2 < a, 


A A EET, 


satisfies the condition of Lemma 3.4.10. By Lemma 3.4.10, (x’/q) - v + e almost has 
the distribution yg and the statistical distance of them is negligible. From (3.4.7), 
x-vu/q +e mod 1 and wg + s- a/q mod | have the same distribution. Above all, 
we get the statistical distance between (a, x - v/q + e mod 1) and A, ,,, is negligible 
so that the algorithm W’ is correct. We complete the proof. 


Combining the above Lemmas 3.4.5, 3.4.7 and 3.4.11, we obtain the conclusion 
of Lemma 3.4.4 immediately, which shows that we can solve the CVP/. 44/./3;) 
problem by the samples of Dz.. In order to prove Lemma 3.4.3 completely, we 
introduce the technique of quantum computation to prove there is an efficient quan- 
tum algorithm to generate a sample from Dy ,. /7/qq based on the algorithm for the 
CVP; ag /(/2r) Problem. 


/aq 


Definition 3.4.4 For a real number a € R and a vector x € R”, we define the Dirac 
notation a|x) = ax. Let A be a finite or countable set in R”, f be a function from 
R” to R, a quantum state is defined by 


Yrs A fax (3.4.8) 


xeEA xeA 


if ea f(x)x converges. 
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The knowledge about Dirac notation and quantum state is an important part of 
quantum physics. Since it involves too much content beyond the scope of this book, 
we will not introduce it in detail. We only provide the Lemmas 3.4.12, 3.4.13 and 
3.4.14 here. The readers could refer to Nielsen and Chuang (2000), Shor (1997) 
for details. The following Lemma 3.4.12 gives the discrete Gauss quantum state on 
lattice, where the lattice L satisfies L C Z”. 


Lemma 3.4.12 Given ann dimensional lattice L C Z”, r > 2” An(L), there exists 
an efficient quantum algorithm to output a state within negligible l distance from 
the following state 


De vew) = D7 paol). (3.4.9) 


xeL xeL 


Let L be ann dimensional lattice, R be a positive number, L/R = {x/R |x € L} 
be a lattice obtained by scaling down L by a factor of R. The following lemma 3.4.13 
claims that the quantum state on lattice is on points of norm at most „y/n. 


Lemma 3.4.13 Let R be a positive integer, L be an n dimensional lattice such that 
A\(L) > 2./n, F be the basic neighborhood of L. vı and v2 are defined by 


v = 5 p(x)|x mod L). (3.4.10) 
xEL/R,|x|<./n 
and 
v2 = >) p(x)|x mod L) 
xeEL/R 
(3.4.11) 
= >) $ p@-y)Ix). 
L/ROF yeL 


Then the l, distance between “+ and ~2 is negligible. 


lui | |v2| 


The following Lemma 3.4.14 gives an algorithm to generate a sample from 
Dz Jaa) based on the algorithm for the CVPz» 4 problem. 


Lemma 3.4.14 Given an n dimensional lattice L, a real number d < ),(L*)/2, if 
there exists an algorithm to solve the CVP r» a problem, then there is an efficient quan- 
tum algorithm to generate a sample from the discrete Gauss distribution Dy fij Zay 


According to Lemma 1.3.6 in Chap. 1, when r > /2q7(L), we have 


aq a a T y ài (L*) 
Je a a Aa 
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replace d in Lemma 3.4.14 with æq /(./2r), then there exists a quantum algorithm to 
generate a sample from the discrete Gauss distribution Dz» /z/ag given the algorithm 
for the CVP}. yg /(/2r) Problem. 


Combine Lemma 3.4.4 with Lemma 3.4.14, for r > J/2q n-(L), we have proved 
that one can solve the CVP} 44 /(./3-) problem given the algorithm for the LWE, 4,y,,,m 
problem and a polynomial number of samples from Dz, and further to generate a 
sample from Dz + /zjaq> Which is the whole proof of Lemma 3.4.3. So far, we get the 
main Lemma 3.4.1 in this subsection and finish the first part of proof for Theorem 
3.3.1, ie. from the algorithm for LWE,, 4,y,,,m problem to solve the DGS JInn:(L)/a 
problem. 


3.4.2 From DGS to Hard Problems on Lattice 


In this subsection, we are to prove that if there is an algorithm to solve the DGS 
problem, then there exists a probabilistic polynomial algorithm to solve the hard 
problems on lattice. Take the GIVP problem as an example, that is, find a set S = 
{s;} C L of n linearly independent vectors in L, such that 


|S| = max |s;| < y (n)$ (B), 


where y(n) > 1 is a function of n, B is the generated matrix of L, (B) is a real 
function of B. Specially, if p = A, then the GIVP problem becomes the SIVP prob- 
lem. In order to complete the proof of reduction algorithm from the hard problems 
on lattice to the DGS problem, we introduce the following two lemmas first. Lemma 
3.4.15 shows that with a positive probability, the samples from discrete Gauss dis- 
tribution are not all contained in a given plane with dimension no more than n. 


Lemma 3.4.15 Given an n dimensional lattice L C R", € < > r> VIe (L), let 
H be a plane in R” with dimension no more than n — 1, x be a sample from the 
discrete Gauss distribution Dz, then 


1 

P H} > —. 

rix ¢ H} I0 

Proof h = (hy, ho, ..., hn) € H, without loss of generality, we suppose that H is 
hı = 0,1.e. the plane of all points with the first coordinate 0, let x = (x1, X2,..., Xn). 
Consider the expectation E[e~*“'/ n], based on Lemma 1.3.2 in Chap. 1, we have 


94 3 Learning with Error 


E [e77] 


x~Dz> 
e77 2x1/7 o =r (x/r) , ent n/t 
~ pr 5 2 
_ det(L*)r" a T gM? 
V2p,(L) Sr 
< det(L" yr” 
S ee 


where y = (Y1, Y2,---, Yn) € L*. Since r//2 > ne(L), we get 
Pyar (L") = 1+ pya (ENO) < 1+ e. 


It follows that 
z [e77 1/7}? E det(L*)r” 


1+8). 
noe Peay 


By Lemma 1.3.2 in Chap. | again, 
br(L) = det(L*)r" p1; (L*) > det(L*)r", 


therefore, 


l+e 9 
E =n (x/r) < ge 
oe oe 


On the other hand, 


g eral D A jere 


x~Dir x€H,x~D,, br(L) 


= 5 Bria) = Pr{x € H}. 


x€H,x~D,, 


According to the above two inequalities, 


9 
Pr{x € H — 
r{x }< 10’ 
that is, i 
P H} 2 —. 
r{x ¢ H} 10 


The lemma holds. 
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Based on Lemma 3.4.15, the following lemma shows that it is possible to find 
n linearly independent vectors from n? independent samples of the discrete Gauss 
distribution Dz „ with probability close to 1, which provides a guarantee for solving 
the GIVP problem later. 


Lemma 3.4.16 Given ann dimensional lattice L C R”, € < > r> V/2n¢ (L), then 
the probability that a set of n? vectors chosen independently from D; , contain no n 


linearly independent vectors is exponentially small. 


Proof Let x1, X2,...,X,2 be n? independent samples from Dz +, fori = 1,2,..., 
n — 1, let B; be the event that 


dim span(x1, x2, . . - , Xin) = dim span(x1, x2,...,X@41)n) < M. 
If none of the events B1, Bo,..., B,-; happens, then 
dim span (x1, %2,...,%,2) = N, 


i.e. there exists n linearly independent vectors in these n? 


the probability of B;, by Lemma 3.4.15, 


samples. Next we estimate 


9 
Pr{x; € span(xı, X2,.-.,Xin)} < 70’ Vin+1<K<j<(i+l1)n. 
Thus, 
9 n 
Pr{Xinti, Xint2> +++» Xatna E SPANI, X2,...,Xin)} < To}? 


that is, 


It follows that 


9 n 
Pr{B, O B2N---A Bri} =1—Pr{B,U---UB,1} È 1 — (n — »(2) ; 
this means the probability that none of B,, B2, ..., B,-1; happens is close to 1, i.e. 
the probability that there are n linearly independent vectors in these n? independent 
samples from Dz „is close to 1. We complete the proof. 


Based on the above preparations, let’s prove the main conclusion in this subsection. 
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Lemma 3.4.17 Given ann dimensional lattice L, € = e(n) < D (L) > vV2n:(L), 
if there exists an algorithm for the DGSg problem, then there is a probabilistic poly- 
nomial algorithm to solve the GIVP, jj, problem. 


Proof By the LLL algorithm we choose the generated matrix $ = [s1, 52,..., Sn] of 
lattice L such that s; < 2”2,(L), 1 <i <n. Let 


An = |S| = max |s;| 
l<i<n 


be the length of the longest column vector in S, then 


ALY S Àn S21). 


For each i € {0,1,..., 2n}, let r; = an, we generate n? independent samples 
from Dz, based on the algorithm of the DGS, problem, and the corresponding sets 
of n? vectors are denoted as So, S},..., S2n. If K < (L), we have 


An = |S| < 2Vnọ (L), 


so S is a solution of the GIVPz mọ problem. If ¢(L) < Àn, then there exists i € 
{0, 1,..., 2n} such that (L) < r; < 26(L) according to Lemma 1.3.6 in Chap. 1, 


n n 2n+1 
An S< 2”Àn(L) <2 Aa ne(L) <2" (L), 


combine rọ = Àn > &(L) with rən = 27nn < 2¢ (L), we know there is r; satisfying 
o(L) < ri < 2¢(L). By Lemma 3.4.16, the probability that S; contains n linearly 
independent vectors v1, v2, ..., Un is close to 1. Based on Lemma 1.3.4 in Chap. 
1, the probability each v; no more than ./nr; < 2,/n@(L) is close to 1. Let V = 
[v1, U2,..., Un], we get |V| < 2,/n@(L), so we find a solution of the GIVP» jag 
problem. This lemma holds. 


In Chap. 2, we have proved that the hard problems on lattice such as the GIVP and 
GapSIVP problems can be reduced to the SIS problem, so the difficulties of solving 
the hard problems on lattice are the same. In Lemma 3.4.17, we prove that if there is 
an algorithm for the DGS problem, then there is a probabilistic polynomial algorithm 
to solve the GIVP problem with positive probability, which can also solve the other 
hard problems on lattice. So far we have completed the second part of the proof 
of Theorem 3.3.1. In the first part, we have proved that if there is an algorithm for 
the LWE problem, then there exists a quantum algorithm to solve the DGS problem. 
Combining the two parts of the proof, we get the feasibility to solve the hard problems 
on lattice based on the algorithm for solving the LWE problem, that is, the difficulty 
of solving the LWE problem is not lower than that of the hard problems on lattice. 
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3.4.3 From D-LWE to LWE 


In this subsection, we will finish the third part of the proof for Theorem 3.3.1, i.e. 
the difficulty of the D-LWE problem is at least as high as that of the LWE problem, 
which is given in the following Theorem 3.4.1. 


Theorem 3.4.1 Letn > 1 be a positive integer, 2 < q <S Poly(n) be a prime num- 
ber, x be a distribution on Zq- Assume that we have an algorithm W to determine a 
sample from the LWE distribution As, or the uniform distribution U with probability 
close to 1, then there exists an algorithm W' to solve s given some samples from the 
LWE distribution As, with probability close to 1. 


Proof Let s = (s1, 52,...,5n) € Zp we give the steps for solving sı of the algo- 
rithm W’, and s2, . . . , Sn could be solved in the same way. For k € Z4, consider the 
following transformation of the LWE sample (a, b), where a is uniformly distributed 
on Zp b=a:s+e,e <x, 


(a, b) — (a + (l, 0, ..., 0), b + 1k), 
here / € Z, is uniformly distributed. If k = sı, then 
b+lk=a-s+tet+ls; = (a+ (l,0,...,0)) -s +e, 


note that a + (l, 0, ..., 0) is also uniform on Zi therefore, (a + (/,0,...,0),b+ 
Ik) has the LWE distribution A, ,. 

On the other hand, if k Æ sı, at this time Ik and b are independent, based on / is 
uniform on Z,, it follows that /k is also uniform on Z4. By Lemma 3.3.2, we get 
b + Ik is uniform on Z4, so (a + (L, 0, . . . , 0), b + Ik) is uniform. By the algorithm 
W, we determine (a + (/,0,...,0), b + Lk) is from the LWE distribution A, , or the 
uniform distribution, and check whether sı is equal to k. Since the number of possible 
values of k is q, we can always find the solution of sı. After solving s2, 53,..., 5, in 
the same way, we get the solution s. The lemma holds. 


In Theorem 3.4.1, we prove that the difficulty of the D-LWE problem is not lower 
than that of the LWE problem and complete the whole proof of Theorem 3.3.1. The 
difficulty from solving the D-LWE problem to the LWE problem, then to the hard 
problems on lattice does not increase. We will further discuss the LWE cryptosystem 
with the probability of decryption error in the next chapter. 
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Chapter 4 ®) 
LWE Public Key Cryptosystem get 


In 2005, O.Regev proposed the first LWE public key cryptosystem at Tel Aviv Univer- 
sity in Israel based on LWE distribution A, ,. Because of this paper, Regev won the 
highest award for theoretical computer science in 2018—the Godel Award. The size 
of public key is O(n?) bits, and the size of private key s and ciphertext is O(n) bits. 
The plaintext encrypted each time is 1 bit. In fact, the LWE public key cryptosystem 
is a probabilistic cryptosystem, which depends on a high probability algorithm. Since 
the security of LWE problem has been clearly proved (see Chap. 3), the LWE cryp- 
tosystem has received extensive attention as soon as it was proposed, and it becomes 
the most cutting-edge research topic in the lattice-based cryptosystem study. 


4.1 LWE Cryptosystem of Regev 


Letn > 1,q > 2 be positive integers, x be a given probability distribution in Z4. By 

Definition 4.3.1 in Chap. 3, the LWE distribution A, , is 
As,x = (a, b) € Z} x Za, 

fox a,s > +e (mod q), E 


where a € Z} is uniformly distributed, s € Z% is the private key chosen at random, 
e € Zq, e < x is called error distribution. LWE cryptosystem depends on LWE 
distribution A, ,, and its workflow has the following three steps: 


(1) Public key. 


First we choose s € Z} at random as the private key, let m = O(nlogq). Then we 
choose m samples distributed from A, ,, (ai, bi) € Zi x Zq» ei E€ Zq, ei < XK 
i <m. Let 

A= lai, a2, ..., Am|nxm = Zy 
© The Author(s) 2023 99 
Z. Zheng et al., Modern Cryptography Volume 2, Financial Mathematics and Fintech, 
https://doi.org/10.1007/978-981-19-7644-5_4 


100 4 LWE Public Key Cryptosystem 


by e 
by ez 

m 

b = . »,e= a X Py 
bm em 


where A is a matrix uniformly at random, e < x” indicates the m samples are 
independent. The public key of LWE cryptosystem is the following (n + 1) x m 
matrix 


A= a é Zyn, (4.1.2) 


If the uniformly random matrix A is given and saved for all the users of LWE 
bı 


bz 7 
cryptosystem, then the true public key isb = | . | € Zy with size O(m) = O(n). 


bm 
The public key and private key satisfy the following equation: 


(=s, 1)A =, e' (mod q). (4.1.3) 


(2) Encryption. 
In order to encrypt plaintext of 1 bit u € Z2, let x € {0, 1}” be an uniformly dis- 
tributed m dimensional vector with each entry 0 or 1. The ciphertext c € Zp is an 
(n + 1) dimensional vector in Z,, defined by 

0 
L 


u- 


fal) =c=Ar+ ( D e Zit, (4.1.4) 


4 
2 


where 0 = | . Zi, ULF] € Z4, L$] is the nearest integer to 4. We call f4 the 


0 
encryption algorithm of LWE. In order to understand the encryption algorithm better, 
we give another definition of f4. 
The following set {1,2,...,m} has 2” subsets. We choose a subset 
S C {1,2,...,m} uniformly at random which is called the index set. Then the 
encryption algorithm f,4(u) for plaintext u € Zz is 


c= fau) = <8) e Zit (4.1.5) 


In fact, the subset S is corresponding to the uniformly chosen vector x € {0, 1}”. 
The above algorithm (4.1.5) was proposed by Regev originally. 
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(3) Decryption. 


We use the private key s € Zi for decryption of the ciphertext c. Actually we only 
need to decrypt for the last entry of vector c. We have 


i. (c) = (=s, le = (~s' Ax +ult 7 | =, ex tulg ] (mod q). (4.1.6) 
The error samples are much smaller than q, namely 


Yei = ex < 141/2. (4.1.7) 


ies 


Therefore, by comparing the distances between the right side of (4.1.6) and 0 or L$] i 
one can decrypt successfully: 


0, if (—s’, 1)c is closer to 0, 


1, if (—s’, 1)c is closer to |4], (4.1.8) 


f= | 


finally we have fy '(c) = u and finish the whole workflow of LWE cryptosystem. 
Both of the encryption algorithm and decryption algorithm of LWE are proba- 
bilistic algorithms, so we should verify the correctness, namely 


Pr{fq (©) =u} > 1 — ô(n). (4.1.9) 
Here 5(n) is a negligible function of n, i.e. ô (n) = o (as = ) , Ve > 0, more precisely: 


lim 6(n)log*‘n = 0, Ve > 0. 
n—->oo 


We prove (4.1.9) with given discrete Gauss distribution x = W,. For a € Z4, 
Zq = {0,1,...,¢— 1}, 


_ ja, ifO0<a LH, 
B ele <¢— 1. (4.1.10) 


For x € T = [0, 1), we define 


27 (4.1.11) 


re x, if0<x< t 
“5 ]i-x, ift<x<1. 


Lemma 4.1.1 Letô > 0,0 < k < m, if the distribution x* satisfies 


Pr. {lel Z 151/2] >18, (4.1.12) 
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then (4.1.9) holds, i.e. 

Pr{fx'(c) =u} > 1-6. 
Proof When we choose the error samples e; € Z4, ei <— x, we can always guaran- 
tee e; = |e;| without changing the probability distribution. By (4.1.7), suppose that 


|S] = k, the corresponding sample 


el 
k 


e=|. |, lel= Yl p? 
As long as (4.1.7) holds, i.e. 
q -1 
lel < 151/2 > fal) =u, 


then 


Pr {f O=} > Pr {lel < 121/2] siss, 


Next we prove (4.1.12) holds for discrete Gauss distribution Wa in Z4. The fol- 
lowing assumptions are made for the selection of parameters: 


n>1,qg>2,n*<q<2n’, 
m= (1 i oe + loa, € > Q is any positive real number, (4.1.13) 
x= Wan)» a(n) = ola) 


where the symbol o indicates 
lim a(n) /nlogn = 0. 


For example, we can choose a(n) = or 


—l! 
Jnlog?n’ 
a(n) = (Vnlog!**n) | , We > 0. 

Lemma 4.1.2 Under the condition for parameters of (4.1.13), for any 0 S k < m, 

we have 


Pr {lel ale 21/2} > 1—8(n), (4.1.14) 


e~We any 


where 5(n) = o (aa z) Ve > 0, is a negligible function. 
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Proof Based on (4.1.13), when n > ng, it is easy to see that 


2 


n q 
O<k<m<4d 1)l —<=. 
m d+e)a+ OER < z5 37 
l 
The k samples e = | : | distributed as yi could be obtained from the k samples 
ek 
X1,X2,..., Xk Of distribution Yg, where 


1 
Xx € [o, J1 e; = |qx;] mod q, 1 <S i <k. 


Here the set of representative elements of Z, is 


Z= faez] -2 <a<ź]. 
2 2 
So we have 
k k 
lel = $ leil = $ laxi] mod q. 
i=l i=l 
Note that i 
2 (Laxil — qxi) mod q S k < F 
i=l 
Therefore, 


k 


k 
q 
X qx mod q < i (>> x) mod 1 < 


i=l i=1 


we have |e| < L31/2. Since Dix mod 1 distributed as W gą, where 


E-a = 0 (z) 


k 
1 
Pr [5x mod 1 < ial =1=8(n), 


i=1 


where 5(n) = vk -a =o (z). We complete the proof. 


104 4 LWE Public Key Cryptosystem 


4.2 The Proof of Security 


To prove the security of Regev’s cryptosystem, we first prove some general prop- 
erties for the probability distribution of Abel group by Impagliazzo and Zurkerman 
Impagliazzo and Zuckerman (1989). 

Let G be a finite Abel group, k > 1 be a positive integer. For any / elements 
£1, 82,---, gı € G, suppose x € {0, 1}, g = (81, 82,---, g1), then 


l 
gx = X rigi x; =Oorl 
i=1 
is called a subsum of {g1, 22, ..., g1}. Randomly choose x € {0, 1}’, let gx denote 


the distribution of subsum, and let U(G) denote the uniformly distribution on G. 


Lemma 4.2.1 For any l elements {g 1, g2,..., gj} uniformly at random, the expec- 
tation of statistical distance between the distribution of subsum and the uniformly 
distribution on U(G) is 
1 
E(A(gx, U(G))) < (IG|/2)?. 


Specially, the probability that the statistical distance is larger than (IG|/2!)4 is no 
more than (|G|/2!)4, ie. 


Pr {A(gx, U(G)) > (IGI/2)*} < (G1/2+. 


Proof Let g = (81, g2,---, gi) be / group elements chosen at random, h € G is a 
given group element. Define P, (h) 


1 
Peh = 5 


’ 


l 
lı € {0, 1} | gx = J xigi =] 


i=l 


we call P,(h) the distribution of subsum for g. In order to prove P,(h) is close to 
uniformly distribution, we first prove the l2 norm between P, (A) and the uniformly 
distribution is very small. In fact, we have: 


1 
> Ph)? = Pr{gx = gx'} = ai t Prigx = gx’, x Ax} 
heG Xx X,X 
Note that for any x Æ x’, 


1 
P — = —. 
oe gx} iG] 
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So the expectation of l2 norm for g satisfy 


e ese ate 
PPG l <te 


heG 


Finally, we have the following estimation 


1 
P,(h) — — 
eE a al 
' 1 2\ 3 
< G|2 P,(h) — — 
E | IG] (E (20 x) ) 


i fi}? 
= |G|? P.(h)? \ — — 
IG| pe a) a 


< (IG|/2!)?. 


We complete the proof. 


The security of LWE public key cryptosystem by Regev is ascribed to the follow- 
ing theorem, which is the most important result in this chapter. 


Theorem 4.2.1 For any € > 0, m > (1+ €)(n + l)logq, if there is a probabilis- 
tic polynomial time algorithm W which distinguishes the plaintext u = 0 or u = 1 
from the ciphertext c, then there exists a polynomial time algorithm solving the 
D-LWEn,g,x,m problem. 


A = ynxm : 
Proof The public key of LWE cryptosystem is A = a where A € Z7” isa 
bı 
matrix uniformly at random, b = | : | € Z/ is an m dimensional vector chosen 


bm 
uniformly. The encryption function f4 (u) is 


c= falu) = Ax + Ga € Ze, x € {0,1%". 
2 
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Since W is a probabilistic polynomial time algorithm, suppose Po(W) is the 
probability that decrypting u = 0 from f4(0) by W, and P;(W) is the probability 
that decrypting u = | from f,4(1), i.e. 


(4.2.1) 


| Po(W) = Pr{W (fa 0)) = 0}. 
P\(W) = Pr{W(fa(1)) = 1}. 


Ifbe Zi is uniformly at random, then LWE distribution As, is uniformly LWE 
distribution. Let P,(W) be the probability of decryption successfully by W under 
the condition of uniformly distribution A, ,. Suppose that 


1 
[PoW) — Pi(W)| > zz» ô > 0. (4.2.2) 


Under the assumption of (4.2.2), we will construct a new algorithm W’ satisfying 


; ; 1 
[Po(W ) — PulW | 2 Sg (4.2.3) 


By (4.2.2), we have 


1 
or |Pi(W) — P, (W) > =. 
2nê 


1 
|Po(W) — P. (W) > =. 
n 


If the first inequality of the above formula holds, let W” = W. If the second inequal- 
ity of the above formula holds, then construct W’ as follows. Let the function 


o be fau) > fau) + (a 
z 


Thus, o maps the LWE distribution (A, b) to (A, b + 1), If b is uniformly 
at random, so is b + T, We define W’ to be the decryption on LWE distribution 
(A, b + 45) by W. According to (4.1.5), 


Po(W) = Pi(W^, Pi(W) = Po(W’), 
so W’ is the algorithm which satisfies (4.2.3). = 
Lets € Z/, the public key sample satisfies distribution of (A, b) € Z7” x Z7 = 


As, y- Let Po(s) be the probability of decryption u = 0 successfully by W’, i.e. 


Po(s) = Pr{W'(fa(0)) = 0}. 
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Similarly, let P,(s) be the probability of decryption successfully by W’ if (A, b) is 
uniformly at random. Suppose 


| ELPo(s)] — ELP.) > (4.2.4) 


2nd’ 


we define i 
Y= fs E€ Zi | | Po(s) — P,(s)| > zat: (4.2.5) 


It’s easy to prove: if s € Z} is uniformly distributed, then we have 


Y n > = 
IYI/4" > 7 
Therefore, in order to prove Theorem 4.2.1, we need to find an algorithm Z to 
determine whether the LWE distribution A, , is uniformly at random for any s € Y. 
The construction of algorithm Z: let R be a probability distribution on Zi which is 
uniform LWE distribution or general LWE distribution when s € Y, i.e. 


R = uniform LWE distribution, or R = As y, s € Y. 


by 
Let A = [a], ..., am] € Las b=]: ]e Ze be m random samples from dis- 


bn 

tribution R. Let Py(R) be the probability of decryption u = 0 successfully by W’, 
where (a, b) = A;,,, s € Y. In the same way, suppose P,,(R) is the probability of 
decryption u = 0 successfully by W’ if R is uniform LWE distribution. We esti- 
mate Po(R) and P,,(R) by using the algorithm W’ polynomial times so that the error 
could be controlled within gty. If | Po(R) — P, (R)| > zr. then the algorithm Z is 
effective, otherwise it is noneffective. 

We first confirm: if R is uniform LWE distribution, then Z is noneffective with 
high probability. Because in this case, (A, b) € Zi" x Zg» bis uniformly at random. 
According to Lemma 4.2.1, the Abel group G = Z} x Zq, we have 


|Po(R) — P,(R)| < 2-2, 


In this case, Z is noneffective. 
If R = As y, where s € Y, we are to prove the algorithm Z is effective with 
probability OE i.e. one can distinguish s € Y from uniform distribution. Since 


|Po(R) — P, (R)| > in the average sense we get 


1. 
4n)? 


1 1 
P Po(R) — P,(R)| => — } 2 —. 
al »(R) — P,(R)| =| : 
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Thus, the algorithm Z is effective for A, ,, s € Y with positive probability. We 
complete the proof of Theorem 4.2.1. 


4.3 Properties of Rounding Function 


The public key of LWE cryptosystem by Regev is A = @. € Zora xm, where 


b' 
bı 
Ae Zł” is a matrix uniformly at random, b = | : | € Z7' is a uniform sample 
bm 
vector (see 4.1.2). In this section we will discuss the sampling technique of public 
key A based on rounding function. 
For Yx € R, let {x} be the fractional part of x, |x] be the closest integer to x, i.e. 


_ [x00 if0< {x} < i. 
el io 1— {x}, if} < {x} < 1. (43.0 
In fact, |x] is the only integer satisfying 
EERTE re ee (4.3.2) 
= ee < Sc, 1 = — — J. 
x es ae ie ae x 5 


We call |x] rounding function, and its properties could be summarized as the fol- 
lowing two lemmas. 


Lemma 4.3.1 (i) |x +n] =n + Ll neZxeR. 

ajag Job IX} A 5. 

il Ei Lr], fie} = L. 

(iii) For any integers a,b € Z, b#0, we have the following division: 
a= |ġlb +r, where —} Ps 

(iv) |x] + Ly] — 1 < Lx + y1 < lx] + Ly] + 1, Yx, y € R. 

(4) = 41. YneZ n> l, x ER. 


Proof By (4.3.2), 
Lx +n] = Llx] +r +n] =n + Lx], 


so (i) holds. If {x} Æ $, then r Æ $, and —4 <r < 5, we have 


L-x] = l-lx] -r] = = Le. 


Ifr = 4, then {x} = 5, and 1 — r = 4, so that 


[-x] = l-lx] = 1+1-=r] = -1 - |x], 
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we have (ii). Property (iii) and (iv) can be proved similarly. To prove (v), let x = 


|x] +r, then =+ < £ < 2, thus, 


2n n 2n? 


Lemma 4.3.1 holds. 


Definition 4.3.1 Lett and q be two positive integers, we define function f : Z > Z 
j fa = LŽa], Va € Z. (4.3.3) 
Lemma 4.3.2 Let a,b € Z, then 

a = b (mod t) => f(a) = f(b) (mod q). 


Proof Since a = b (mod t), we write a = st + b, therefore 


fla) = [2(st +b) = Lsq + 2b] = sq + [2b] = sq + FO) 


So we have f(a) = f(b) (mod q). 


By the above lemma, f is a function from Z, to Zg we can define its ‘inverse 
function’ f7! : Z4 > Z, as follows 


7 Qe a Vb € Z4. (4.3.4) 


Lemma 4.3.3 (i) Ift < q, then Ya € Z, we have 
f'f@ =a. 
(ii) Ift >q, anda € Z is uniformly chosen at random, we have 
Pr{f f(a) #a}=1-— F (4.3.5) 


Proof We first prove (i). If t = q, then 


f(a) = LŽa] = |a] =a => f7 f(a) = f'(a) = lza] = |a] =a, Va € Z. 


Ift < q, then = > $, based on the definition of rounding function, 


q 1 q q 1 
< <—at+-, 
1’ 2 La n 2 
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it follows that 


So we can get 


this is equivalent to 


Thus, : 
ee ne ee =a. 
q t q t 


This means that 
ffa =a, Va eZ. 


Next we prove (ii), at this time q < t. By Lemma 4.3.2, we only need to consider 
how many elements a in Z, that satisfies f~! f(a) 4 a. By (i) we get 


LILET =b, Vb € Zy. 
tq 


This is equivalent to 


f (1401) =b, Wb € Z4. 


So we have 


S'S (1n) = f'(b) = aI, Vb € Z4. 


Here 0, [z] ; [z] VETA [e] are different from each other in Z;. Next we prove 


that the number of a in Z, satisfying f~'(f(a)) = a is no more than q. Let A be the 
set containing all the elements satisfying f~'(f(a)) = ain Z;. Ya, a2 € A, a1 # a 
inZ,, then we have f (a1) # f (a2) (mod q),i.e. f (a1) A f (a2) inZ,. This means the 


number of A is no more than q. Above all, it shows that 0, l] s [z] TANNET [| 


are just all the numbers in Z, such that f “1 Ff (a)) = a. Based on a is uniformly 
chosen in Z,, then 
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Prif f(a) #.a} = 1-4. 


We complete the proof. 


In order to generalize the function f and f~! from one dimension to high dimen- 
sion, we give the following definition. 


Definition 4.3.2 Lett, q, l be positive integers, we define function F : Z! > Zi, as 
F f4 q q 1 _ 1 
(a) = (Lal, L721- Lael) € Z,, Ya = (a, ™,..., a1) E€ Z,, (4.3.6) 


and the ‘inverse function’ F~! : Zi, — Zi as 


t t t 
F~ (b) = (ear Lebel Lon) € Zi, Yb = (bi, bz, ...,b)) € Z}. 


(4.3.7) 
Lemma 4.3.4 Va = (a), @2,..., a1) € Zi, if a is uniformly at random and 
ai, 2,..., a; are mutually independent, we have 
1 q\! 
Pr{F7! F(a) # a} = max fo, i ($) | (4.3.8) 


Proof Ift < q, from Lemma 4.3.3, 
f f(a) = ai, Yai € L, VICI <l. 


So 
F~! F(a) =a, Ya € Zl. 


l 
Pr{ F7 F(a) £ a} = 0 = max fo, le (7) | : 
Ift > q, from Lemma 4.3.3, 
Prt fo! f (ai) = ai} = a aic Z,YL<i<l. 


Since a), d2,..., aj are independent, therefore, 


PriF-'F(a) =a} = (2), a e Zi. 
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Prle1F(@) # a) = 1 = (F) =maxl0.1— N 


We finish the proof. 


4.4 General LWE-Based Cryptosystem 


We introduced the LWE cryptosystem proposed by Regev in Sect. 4.1 and proved its 
security in Sect. 4.2. However, it could only encrypt a single bit of plaintext and the 
efficiency is low. Based on the definition and properties of rounding function given 
in Sect.4.3, Regev presented a general LWE cryptosystem in 2009 Regev (2010), 
which could encrypt multiple bits of plaintext v € Z} with size O(t’) and improve 
the efficiency signally. In this section, we introduce general LWE cryptosystem first. 
Then we discuss the probability of decryption error for this cryptosystem and prove 
that it could be sufficiently small with suitable parameters. So we verify our core 
result that the LWE cryptosystem could have high security. 

Lett, q, m, n, l, r be positive integers, q > t, function F and its ‘inverse function’ 
are defined in 3.2. The workflow of general LWE cryptosystem is as follows: 


(1) Selection of private key S: S € grs is an n x l matrix uniformly at random in 
Zq. 
In the LWE cryptosystem introduced in Sect. 4.1, the private key is an n dimen- 
sional randomly chosen vector s € Z}. To encrypt more general plaintext v € Zl, we 
randomly select / private keys s1, 52,..., 5; € Zi independently and form ann x l 
matrix S = [s1, 52,..., sı]. This is the private key S for general LWE cryptosystem. 


(2) Public key. 

When the private key S € ag is fixed, in order to choose samples from LWE 
distribution, we first select m uniform n dimensional vectors a4, d2,..., am € Zi in 
Zi and form a uniform random matrix 


nxm 
A= [a1, a2,-+-,Am|nxm c€ Zi : 


Then we generate m x l noise matrix samples E = (E;j)mxı from distribution Wor 
where Wo is defined by (4.4.1) and (3.3.13), ie. Ei; € Zg, Eij <— Was I<i<m, 
1 < j < L, and the m x l samples are mutually independent. Finally we get an m x l 
matrix P 


< di, s1 >+E\ aed < a, 5 > +E 
P=A'S+E= 


< dm, S1 > +Emi > < Am, SI > + Emi mx 
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The public key of LWE cryptosystem is (A, P), which is similar to that in Sect. 4.1. 
Here we only change the public key from b € Zy to m x | matrix P € ZSE, If the 
uniformly random matrix A is given and saved for all the users of LWE cryptosystem, 
then the true public key is the matrix P, and the public key and private key satisfy 
the following equation 

P — A" S =, E (mod q). 


(3) Encryption. 
To encrypt multiple bits of plaintext v € Z!, let a € {—r, —r + 1, ..., r}” be an m 
dimensional vector with each entry selected uniformly in {—r, —r + 1,...,r},i.e.a 


is uniformly distributed. Ciphertext (: is an n + l dimensional vector, defined by 


ga PO) = (‘) , u = Aa, c= P'a+ F(), 


where F is defined in (4.3.6), and g4,p is called the encryption algorithm of LWE 
cryptosystem. 


(4) Decryption. 
Given ciphertext (u, c) and the private key S, we compute F~!(c — S7u) as the result 
of decryption. We have 


F-\(c — STu) = F`! (PTa + F(v) — S'u) 
= F-!((A'§ + E)'a+ F(v) — S7 Aa) 
= F! (Ea + F(v)). 


Next we calculate the probability of decryption error for this cryptosystem, namely 
the probability of F7! (ETa + F(v)) Æ v. The following Theorem 4.4.1 gives an 
estimation for this probability, which is the main result of this section. 


Theorem 4.4.1 Suppose q > t, we have the following inequality of the probability 
of decryption error 


Pr{F-! (ETa + F(v)) £v} < z2 (ı a a 5): (4.4.1) 


Here ® is the cumulative distribution function of the standard normal distribution, 
2 

=f 1-5 

ie. D(x) = La me”? dt. 

Proof Denote v=(v1, v2, ..., v1), Emxı = (E1, E2, ..., E1), where E1, E2,..., Ei 

are all m dimensional column vectors. Let f7! (E 7 a + f (vi)) be the ith coordinate 

of F7! (ETa + F(v)), 1 <i < l. According to the definition of rounding function, 
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[fui < 
< j , 
2 Vi pwi fies 
t t q t 
2q = Lvl Vi < 2q° 
So if |+ E7a} < 5 — +, we get 
t t 1 


It follows that ; 


q 


t 
Etat (2 S97 =0, 
q t 


this means 
E SE A, 
L-E; a+ -l>vil] = vi, 
q q t 


f (ETa + f0) = vi. 


t 
2q? 
if fo! (ET a+ f (vi) Æ vi, i.e. the decryption error occurs in the ith letter, then 


LEa] > 5 E a So the probability of decryption error in one letter is no more 


namely if |; Ej al < 5 — we can get f~'(E/a+ f(vi)) = vi. Equivalently, 


than the probability of 


LET Datri 
LETa| 25 zg Le. 


Pr aire (ETa + f()) # vi} < Pr [|era 


1 t 
2 Ae 
2 2q 


The next step we estimate the probability of | Ej a| > 5 < PE Since each coor- 


dinate of E; is chosen independently from the Gaussian distribution with mean 
0 and standard deviation œq/v/27r and the sum of independent Gaussian vari- 
ables is still a Gaussian variable, Ela is also a Gaussian distribution variable. Let 
a = (a), 42, ..., Am) and each a; is chosen from {—r, —r + 1,--- , 7} uniformly at 


random, then 
= = 1 aos 
POS r+(-r+1)+ EL, 
2r+ 1 


(=r) + (—r +1? ++- r? tier) 


Var(a;) = = 
ae) 2741 3 


E(E} a) = 0. 
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2 
Var (E?a) = ( aq ) TANS os aq? mr(r + D 
3 67 


V27 7 


Therefore Ela is treated as anormal distribution with mean 0 and standard deviation 


aqVJ/mr(r + 1)// 6x. We have 


=" |E? \/ /mr(r + 1) Ț 412! 670 
ee os "q 6r á 2atq \ mr(r + 1) 
q—t 6r 
a 2(1 sd Grr \ mr(r + o) 


So we get the following inequality for probability of decryption error of the LWE 
cryptosystem 


Pr{F!(E"a + F(v)) Æ v} 


<SIPr {f (Efa + fOD) # vi 


1 t 
2 -— — 
2 2q 


_ q-t 6m 
~ aà a \ mr(r + 5) 


The upper bound could be as closed as 0 if we choose œ small enough. It means 
that the probability of decryption error for the LWE cryptosystem could be made 
very small with an appropriate setting of parameters. 


4.5 Probability of Decryption Error for General 
Disturbance 


In this section we estimate the probability of decryption error for the LWE cryp- 
tosystem when the noise matrix E = (E£;j;)m xi is chosen independently from a gen- 
eral common variable, rather than Gauss distribution. We have the following theorem. 
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Theorem 4.5.1 q >t, E = (Eij)mxı, each element Ej; is selected independently 
from a common random variable of mean 0 and standard deviation B. For any 5 > 0, 
we can find positive integer m, such that the following inequality of the probability 
of decryption error holds, 


Pr{F- (ETa + FO)) £v} < 2i(1 (TF =S a) +18, (4.5.1) 


Here ® is the cumulative distribution function of the standard normal distribution, 


i.e. (x) = i. Aue Tat. 


Proof Similarly as the proof of Theorem 4.4.1, we need to estimate the proba- 
bility of |; Ej al > 5 E i" Since the coordinates of E/ are independent identi- 
cally distributed, E/ and a are also independent. By central limit theorem Riauba 


(1975), ETa is approximately normal distribution with mean 0 and standard devia- 


tiond = ym Var(E;ij)Var (a;i) = B mrt hy Thus, for any sufficiently small ô > 0, 
there is a positive integer m such that 


-pP fiera (F 2) >it) goan 2)] 
P |EZal B mr(r + 1) Oe feed) 3 
= ial / | Py —G * Opt ¥ mr +1) 
=2(1 a(t : )) +e 
26t \ mr(r +1) ? 


Here |e| < 5. Then we get the following inequality for probability of decryption error 
of the LWE cryptosystem for general disturbance 


Pr{F-\(E'a+ F(v)) £v} 


<iPpr iy (ETa + f(vi)) # vi} 


1 t 
2 -— — 
2 2q 
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_ q-t 3 

= u(1— o 26r \ Tra) ale 
q-t | 3 

< a(ı ?( 26t \ mr(r + 5) a; 


This probability could be also closed to 0 if we choose the parameter 6./m and ô 
small enough. Therefore the probability of decryption error of the LWE cryptosystem 
for general disturbance could be made very small, which leads to high security. 


Example 4.5.1 Lett = 2,q =5,/=1,m=1,r = 1,5 = 107°, 8 = 107°, v € Z2 
is uniformly chosen at random, the disturbance E is a random variable with the 


distribution yg such that P{E = k} = L eb for positive integer k and Pr{E = 
0} = e’, a e {—1, 0, 1} is uniformly chosen at random. Then the probability of 


decryption error 


Pr{F! (Ea + F(v)) £v} = Pr {15 (£a + BM = r} 


-1p 2E 0 lp "iE 2 1 
=a ate a] # lez JE a+2)]| #4 | 


< SPE 40) + S PME £0} 


=1-Pr{E=0}=1 ge et < 107°. 


On the other hand, 


q-t 3 3 
a(i- o/ re eae 5)) +18 > 107, 
So it follows that 
= 3 
Pr{F“(Ea + F(v)) £v} < a(ı aar r = 5) +18, 


The inequality in Theorem 4.5.1 holds. 


Example 4.5.2 Lett = 2,g = 5,1l = 1,m = 1,r = 1,8 = 1074, à = 0.05, v € Z2 
is uniformly chosen at random, the disturbance E is a Laplace distribution variable 


|x| 


with probability density function f(x) = xe z rounding to the nearest integer, a € 
{—1, 0, 1} is uniformly chosen at random. Similarly as Example 4.5.1, the probability 
of decryption error 
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Pr{F! (Ea + F(v)) £v} = Pr h (£a + My = r} 


Nie 


1 w 10 4 
<1-Pr{E=0js=1- | —e +tdx=e < 10". 
2) 
1 
=3 


On the other hand, 


q-t 3 
26t \ mr(r+ 1) 


a(1-o( )) +16 > 10. 


We have 


q-t 3 
26t \ mr(r + z) T 


Pr{F! (Ea + F(v)) £v} < a(ı o( 


The inequality in Theorem 4.5.1 holds. 
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Chapter 5 A) 
Cyclic Lattices and Ideal Lattices get 


Cyclic lattices and ideal lattices were introduced by Micciancio (2002), Lyuba- 
shevsky and Micciancio (2006), respectively, which play an efficient role in Ajtai’s 
construction of a collision-resistant Hash function and in Gentry’s construction of 
fully homomorphic encryption (Gentry, 2009a). Let R = Z[x]/ < (x) > be a quo- 
tient ring of the integer coefficients polynomials ring, Lyubashevsky and Micciancio 
regarded an ideal lattice as the correspondence of an ideal of R, but they neither 
explain how to extend this definition to whole Euclidean space R”, nor exhibit the 
relationship of cyclic lattices and ideal lattices. In this chapter, we regard the cyclic 
lattices and ideal lattices as the correspondences of finitely generated R-modules, so 
that we may show that ideal lattices are actually a special subclass of cyclic lattices, 
namely cyclic integer lattices. It is worth noting that we use more general rotation 
matrix here, so our definition and results on cyclic lattices and ideal lattices are 
more general forms. As application, we provide cyclic lattice with an explicit and 
countable upper bound for the smoothing parameter. Our results may be viewed as 
a substantial progress in this direction. 


5.1 Some Basic Properties of Lattice 


At the beginning of Chap. 1, we have introduced the definition of lattice in R”. A 
lattice is actually a discrete additive subgroup. In this section, we mainly give some 
properties of lattice that will be used later in this chapter. 


Lemma 5.1.1 Let L C R” be a lattice, 0), 02,...,Qm € L be m vectors of L. Then 
&1, 02, ..., @m» are linearly independent over R, if and only if they are linearly inde- 
pendent over Z. 


Proof If a), a2, ..., @m are linearly independent over R, trivially which are linearly 
independent over Z. Suppose that a}, @2,...,@m are linearly independent over Z, 
we consider arbitrary linear combination over R. Let 


AQ) + a202 + +++ + amm = O, (5.1.1) 
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We should prove (5.1.1) is equivalent to a; = az = --- = am = 0, which implies that 
G1, Q2,..., @» are linearly independent over R. 

By Minkowski’s Third theorem (see theorem VII of Cassels (1963)), for any suffi- 
ciently large N > 1, there are a positive integer q > 1 and integers p1, p2,..., Dm E 
Z such that 

max |qai— pil<No™, 1<q<QN. (5.1.2) 


By (5.1.1), we have 


| picy + P22 +-+ Pm&m| 
= |(qaı — pı)&ı + (Gaz — p2)&2 + +++ + (qam — Pm)On| 


1 
<mN~™ max |aj|. (5.1.3) 
l<i<m 


Let à be the minimum distance of L, € > 0 be any positive real number. We select 
N such that 
m\™ 7mym 
N > max | (7) 7 (=) max xl" 
E€ À l<i<m 


It follows that mN~m < € and 


ai 
mN`™ max |aj| <A. 
l<i<m 


By (5.1.3) we have 
| pid + pra2 + +--+ Pmom| < À. 


Since Pi, + preg +: + + PmAm E L, thus we have pia + pra + ++: + Pm lm = 
0, and py = p2 = +--+ = pm = 0. By (5.1.2) we have g|a;| < Łeforalli, 1 <i<m. 
Since € is sufficiently small positive number, we must have aj = a? = --- = am = 0. 
We complete the proof of lemma. 


Suppose that B € R”*™ is an n x m dimensional matrix and rank(B) = m, BT 
is the transpose of B. It is easy to verify 


rank(B’ B) = rank(B) = m => det(B’ B) £0, 
which implies that B7 B is an invertible square matrix of m x m dimension. Since 
B’B is a positive defined symmetric matrix, then there is an orthogonal matrix 


P e R”*” such that 


P7 B" BP = diag{ô1, 52,..., dm}, (5.1.4) 
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where ô; > 0 are the characteristic value of BTB, and diag{ô1, 52,..., Ôm} is the 
diagonal matrix of m x m dimension. 


Lemma 5.1.2 Suppose that B € R"*” with rank(B) = m, ôi, ô2,..., ôm are m 
characteristic values of BT B, and (L(B)) is the minimum distance of lattice L(B), 
then we have 
A(L(B))= min |Bx|> V5, (5.1.5) 
xeZ”, xA0 


where ô = min{6,, d2,..., dm}. 


Proof Let A = B7” B, by (5.1.4), there exists an orthogonal matrix P € R”* such 
that 
PAP = diag{5, 52,..., Sm}. 


If x € Z”, x Æ 0, we have 


X = xX X=X x 
Bx|?=x7A T P(PTAP)PT 
= (P' x)" diag{6,, ô2, ... , ôm} PT x 
> ô|PT x]? = d|x|?. 


Since x € Z” and x Æ 0, we have |x|? > 1, it follows that 


min |Bx| > V8\x| > v. 


xeZ™, x 


We have lemma 5.1.2 immediately. 


Another application of lemma 5.1.2 is to give a countable upper bound for smooth- 
ing parameters in Sect.5.4. A sublattice N of L means a discrete additive subgroup 
of L, the quotient group is written by L/N and the cardinality of L/N is denoted by 
|L/N|. 


Lemma 5.1.3 Let L C R” bea lattice and N C L bea sublattice. If rank(N) =rank 
(L), then the quotient group L/N is a finite group. 


Proof Let rank(L) = m, and L = L(B), where B € R”*” with rank(B) = m. We 
define a mapping o from L to Z” by ø (Bx) = x. Clearly, o is an additive group 
isomorphism, o (N) C Z” is a full-rank lattice of Z”, and L/N = Z” /o(N). Itisa 
well-known result that 

|Z" /o(N)| = det(o (N)), 


It follows that 
|L/N| = |Z" /o(N)| = det(o(N)). 


Lemma 5.1.3 follows. 
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Suppose that Lı C R”, L2 C R” are two lattices of R”, we define Lı + L2 = {a+ 
bla € Li, b € L2}. Obviously, Lı + Lo is an additive subgroup of R”, but generally 
speaking, Lı + L2 is not a lattice of R” again. 


Lemma 5.1.4 Let L; C R", Lo C R” be two lattices of R". Ifrank(L, O L2) =rank 
(Lı) or rank(L; N L2) =rank(L2), then Lı + L is again a lattice of R". 


Proof To prove Lı + Lz is a lattice of R”, it is sufficient to prove Lı + L2 is a 
discrete subgroup of R”. Suppose that rank(L; N L2) =rank(L,), for any x € Ly, 
we define a distance function p(x) by 


p(x) = inf(lx— yl | y #x, y € La). 


Since there are only finitely many vectors in L2 N N(x, ô), where N(x, ô) is any a 
ball of center x with radius ô. Therefore, we have 


p(x) = min{|x — y| Jy #x, y e L} =à; > 0. (5.1.6) 
On the other hand, if x; € L1, x2 € Lı and xı — x2 € Lo, then there is yọ € L2 such 
that xı = x2 + yo, and we have p(x1) = p (x2). It means that p(x) is defined over 
the quotient group Lı + L2/L2. Because we have the following group isomorphic 
theorem 
Lı + L2/L2 S Lı/L1 A Lp, 
By lemma 5.1.3, it follows that 


[Ly + L2/L2| = |L1/L1 A L| < œ, 


In other words, Lı + L2/Lz is also a finite group. Let x1, x2,..., x, be the repre- 
sentative elements of Lı + L2/L2, we have 


min |x — y| = min p(x;) > min{às , Axs... Ax} > 0. 
xeL,yelz,x#y NAN 


Therefore, Lı + L2 is a discrete subgroup of R”, thus it is a lattice of R”. 


Remark 5.1.1 The condition rank(L; N L2) = rank(L1) or rank(L; N L2) = rank 
(L2) in lemma 5.1.4 seems to be necessary. As a counterexample, we see the real 
line R, let L; = Z and L> = /2Z, then Lı + L3 is not a discrete subgroup of R, 
thus Lı + L2 is not a lattice in R. Because Lı + L = {n + V2m|n € Z,m € Zhis 
dense in R by Dirichlet’s theorem (see theorem I of Cassels (1963)). 

As a direct consequence, we have the following generalized form of lemma 5.1.4. 


Lemma 5.1.5 Let Li, L2, ..., Lm be m lattices of R” and 


rank(Lı N L2 N --- N Lm) = rank(L;) for some l S j Sm. 
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Then Lj + Lo +- -- + Ly is a lattice of R". 


Proof Without loss of generality, we assume that 
rank(L; N L2 O --- ON Lm) = rank(L,,). 
Let Li + L2 +--+ Lm-1 = L’, then 
L' + Lm/L' = Lm/L' A Lm. 


Since rank(L’ N Lm) =rank(L,,), by lemma 5.1.4, we have L’ + Lm = Li + La + 
--- + Ln is a lattice of R” and lemma 5.1.5 follows. 


5.2 Ideal Matrices 


In Chap. 3 we introduced the concept of circulant matrix and some related properties. 
In this section, we generalize them to general ideal matrix and introduce the properties 
of ideal matrix. By using the characteristic polynomial (x) as modulo and the 
definition of -convolutional product, we establish the ring isomorphism one-to-one 
correspondence between polynomial quotient rings and n dimensional vectors in R”. 

Let R[x] and Z[x] be the polynomial rings over R and Z with variable x, respec- 
tively. Suppose that 


b(x) = x" — bp_1x""| — - -- — dix — po € Zix], bo #0 (5.2.1) 


is a polynomial with integer coefficients of which has no multiple roots in com- 
plex number field C. Let w1, w2,..., Wn be the n different roots of (x) in C, the 
Vandermonde matrix Vg is defined by 


1 1 1 
w1 w2 eee Wn 

y=. . . |, det(Vs) £0. (5.2.2) 
w”! w37! wn? 


pi 


eZ", (5.2.3) 
Tn-1 


Pn—1 


nxn 
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where /,_; is the (n — 1) x (n — 1) unit matrix. Obviously, the characteristic 
polynomial of H is just @(x). We use column notation for vectors in R”. Let 


{€9, €],---, €n—1} be the standard basis of R”, see (5.1.2) in Chap. 3. 
fo 
- fı . . 
Definition 5.2.1 For any f = . € R”, the ideal matrix generated by vector 
Sn-1 


f is defined by 
H*(f) =f, Hf, H7f,..., H! flaxn € R”, (5.2.4) 


which is a block matrix in terms of each column H* f (0 <k <n-—1). Sometimes, 
f is called an input vector. In Chap. 3, we introduced the definition of circulant matrix. 
Itis easily seen that H*( f) is amore general form of the classical circulant matrix and 
r-circulant matrix (Shi, 2018; Yasin and Taskara, 2013). In fact, if ø (x) = x” — 1, 
then H*(f) is the ordinary circulant matrix generated by f. If (x) = x” — r, then 
H*(f) is the r-circulant matrix. 


By (5.2.4), it follows immediately that 


H*(f +g) = H*(f) + H* (8), (5.2.5) 
and 
H* (Af) =AH*(f), YA ER. (5.2.6) 
fo 
Specially, for any f = : € R”, the ideal matrix H*(f) generated by f could 
Sn-1 


be written as 


n—-1 n—l1 
H*(f) = H* (x fai) =J AH e 


i=0 i=0 


which means that any ideal matrix is the linear combination of ideal matrices gener- 
ated by the standard basis vectors e;. It is easy to verify that 


H*(eo) = In, H*(e) = H*, 1<k<n-l, 


So the unit matrix J,, and rotation matrices H* (1 <k <n-—1) are all the ideal 
matrices. 

Moreover, H*(f) = 0 is a zero matrix if and only if f = 0 is a zero vector, thus 
one has H*(f) = H*(g) if and only if f = g. Let M* be the set of all ideal matrices, 
namely 

M* = {H*(f)| f € R’}. (5.2.7) 
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We may regard H* as a mapping from R” to M* of which is a one-to-one corre- 
spondence. Next we show some basic properties for ideal matrix, and more contents 
could be found in Zheng et al. (2022a). 


Lemma 5.2.1 For any f € R”, we have 
H: H*(f) = H*(f)- H. (5.2.8) 


Proof Since ġ (x) = x” — gn x"! — - -- — bx — Qo is the characteristic polyno- 
mial of H, by Hamilton—Cayley theorem, we have 


H” = pol, + QH +--+ pra H". 


Qı 


By (5.2.4) we have 


H*(f)H = [f, Hf, ..., H"! f] = 3 
= (Hf, H? f, H f bof + Hf ++ pai H" f 
= [Hf, H?’ f, ..., H”! f, H” f] 
= HIF Bfe H""'f|=H-H*(f), 


The lemma follows. 


fo 
1 
Lemma 5.2.2 For any f = F e R” we have 
Jai 
H* (f) = foln + fH +-+ faa H". (5.2.9) 


Proof We use induction on n to show this conclusion. If n = 1, it is trivial. Suppose 
it is true for n, we consider the case of n + 1. For this purpose, we write H = H,, 


€0, €1, «++, €n—1 the n column vectors of unit in R”, namely 
1 0 0 
1 0 
e0 = €15 An = 
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_ (0 Ao 
Hn+ı = (C a) ’ 


where Ao = (0, 0, ..., ġo) € R” is a row vector. For any k, 1 < k < n — 1, it is easy 
to check that 


and 


A Hk! 
Haek—-1 = €k, Hkey = er and H% | = (.° aah ). 


ri H 
fo 
fi 
Let f=| : | €R"t!, we denote f’ by 
Sn-1 
Stn 
fi 
hr fi 
Bes R”, = J 
l r=(j 
tn 


By the assumption of induction, we have 


Ax(f’) = Lf, H, f’, sees H! f'] = filn F faHn s SaS F in, 


Ay (P) = i) ’ An+1 C) pereg Hiya (£) 


= folnt+ fiHn +H fa Hia. 


it follows that 


We complete the proof of lemma 5.2.2. 


Lemma 5.2.3 Let f(x) = fo + fix +-+ + fa-1x"7! € R[x], then we have 
H*(f)= V; 'diag{ f (w1), f(w2), 5 f (Wn)} Ve, (5.2.10) 


where diag{ f (w1), f (w2), ..., f (wn)} is the diagonal matrix. 


Proof By theorem 3.2.5 of Davis (1994), for H, we have 


H = V; 'diag{wi, w2, ..., Wn} Vo, 
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By lemma 5.2.2, it follows that 


H*(f) = Vy" diag {f (wi), f (wa), 5 f (Wn) }Vo- 


Now, we summarize some basic properties for ideal matrix as follows. 


Lemma 5.2.4 Suppose ġ (x) € Z[x] is a polynomial of which has no multiple roots 
in complex number field C. f € R", g € R" be two column vectors, we have 


(i) H*(f)H*(g) = H*(g)H*(f); 
(ii) H*(f)H"(g) = H*(A*(f)g); 
(iii) det(H*(f)) = M; f (wi); 
(iv) H*(f) is an invertible matrix if and only if ọ (x) and f (x) are coprime, i.e. gcd 
((x), fœ) = 1. 


Proof (i) and (ii) follow from lemma 5.2.2 immediately, (iii) and (iv) follow from 
lemma 5.2.3. 


In Sect. 3.1, we took the characteristic polynomial x” — 1 as modulo and con- 
structed the one-to-one correspondence between polynomial quotient rings and n 
dimensional vectors. Now we can generalize it to the general case using characteris- 
tic polynomial (x) as modulo. Let ¢(x)R[x] and ¢(x)Z[x] be the principal ideals 
generated by $(x) in R[x] and Z[x], respectively, we denote the quotient rings R 
and R by 

R = 2Z[x]/@()Z[x], R = R[x]/¢(~) R[x]. (5.2.11) 


There is a one-to-one correspondence between R and R” given by 


fo 
f(x) = fot fixt---+frix™ !eR<> f= : eR”. (5.2.12) 
fa 
We denote this correspondence by f, that is 
t(f(x)) = f, Cf) = fF). (5.2.13) 


If we restrict ¢ in the quotient ring R, then which gives a one-to-one correspondence 
between R and Z”. First, we show that f is also a ring isomorphism. 


Definition 5.2.2 For any two column vectors f and g in R”, we define the ¢- 
convolutional product f * g by 


fxg =H*(f)g. (5.2.14) 
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By lemma 5.2.4, it is easy to see that 
f*g =g x f, and H*(f * g) = H*(f)H* (8). 
Lemma 5.2.5 For any two polynomials f (x) and g(x) in R, we have 
Hf (x)ge(x)) = H*(f)g = f * g. (5.2.15) 
Proof Let g(x) = go + gix +--+ 8n-1x"7! € R, then 
xg (x) = PoSn—1 + (80 + P18gn-1)X +- + (Bn—2 + @n-18n-1)x"7', 


it follows that 
t(xg(x)) = Ht(e(x)) = Hg. (5.2.16) 


Hence, for any 0 < k < n — 1, we have 
t(x*g(x)) = H*t(g(x)) = H*g, 0<k<n-1. 
Let f(x) = fot fix +--+ + fa-ıx"7! € R, by lemma 5.2.2, we have 


n—-1 n—-1 


FOE = > fit’ g(x) = Y fig = A (fg. 


i=0 i=0 


The lemma follows. 


Lemma 5.2.6 Under $-convolutional product, R" is a commutative ring with iden- 
tity element ey and Z" C R” is its subring. Moreover, we have the following ring 
isomorphisms 

R S R" S M*, R & Z" & Mj, 


where M* is the set of all ideal matrices given by (5.2.7), and Mj is the set of all 


integer ideal matrices. 


Proof Let f(x) € R and g(x) € R, then 


(f(x) + g@)) = f +g =t(f@)) +t(gQ@)), 


and 


t(f(x)g(x)) = H* (Pg = f * 8g =t(f@)) *t(g@)), 


this means that is aring isomorphism. Since f x g = g x f andeo * g = H*(eo)g = 
Ing = g, then R” is a commutative ring with eg as the identity elements. Noting 
H*(f) is an integer matrix if and only if f € Z” is an integer vector, the isomor- 
phism of subrings follows immediately. 
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According to property (iv) of lemma 5.2.4, H* ( f ) is an invertible matrix whenever 
(f(x), 6(x)) = 1 in R[x], we show that the inverse of an ideal matrix is again an 
ideal matrix. 


Lemma 5.2.7 Let f(x) € R and (f(x), @(x)) = 1 in R[x], then 
(H* (f)! = H*(u), 
where u(x) € R is the unique polynomial such that u(x) f (x) = 1 (mod $(x)). 


Proof By lemma 5.2.5, we have u x» f = eọ, it follows that 
A*(u)H*(f) = H* (eo) = Ih, 


thus we have (H*(f))~! = H* (u). It is worth to note that if H*(f) is an invertible 
integer matrix, then (H*(f))~' is not an integer matrix in general. 


Sometimes, the following lemma may be useful, especially, when we consider an 
integer matrix. 


Lemma 5.2.8 Let f(x) € Z[x] and (f(x), 6(x)) = 1 in Z[x], then we have (f (x), 
o(x)) = 1 in R[x]. 


Proof Let Q be the rational number field. Since (f(x), é(x)) = 1 in Z[x], then 
(f(x), 6(x)) = 1 in Q[x]. We know that Q[x] is a principal ideal domain, thus there 
are two polynomials a(x) and b(x) in Q[x] such that 


a(x) f(x) + b@)b(x) = 1. 


This means that (f(x), @(x)) = 1 in R[x]. 


5.3 -Cyclic Lattice 


As we know that cyclic code plays a central role in algebraic coding theorem (see 
Chap. 6 of Lint (1999)). In Zheng et al. (2022a), we extended ordinary cyclic code 
to more general forms, namely $-cyclic codes, which will be introduced in Chap. 7. 
To obtain an analogous concept of @-cyclic code in R”, we note that every rotation 
matrix H defines a linear transformation of R” by x > Hx. 


Definition 5.3.1 H is the rotation matrix defined in (5.2.3). A linear subspace C C 
R” is called a d-cyclic subspace if Va € C > Ha € C. A lattice L C R” is called 
a @-cyclic lattice if Va € L > Hae L. 


In other words, a -cyclic subspace C is a linear subspace of R”, of which is 
closed under linear transformation H. A ¢-cyclic lattice L is a lattice of R” of which 
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is closed under H. If @(x) = x” — 1, then A is the classical circulant matrix and 
the corresponding cyclic lattice was first appeared in Micciancio Micciancio (2002), 
but he does not discuss the further property for these lattices. To obtain the explicit 
algebraic construction of @-cyclic lattice, we first show that there is a one-to-one 
correspondence between @-cyclic subspaces of R” and the ideals of R. 


Lemma 5.3.1 Let t be the correspondence between R and R” given by (5.2.13), 
then a subset C C R” is a ¢-cyclic subspace of R”, if and only if t~! (C) C R is an 
ideal. 


Proof We extend the correspondence ż to subsets of R and R” by 
C(x) CR —> C= {c| cœ) € CX) CR". (5.3.1) 


Let C(x) C R be an ideal, it is clear that C C t(C(x)) is a linear subspace of R”. To 
prove C is a ġ-cyclic subspace, we note that if c(x) € C(x), then by (5.2.16) 


xc(x) € C(x) & At(c(x)) = Ac EC. 
Therefore, if C(x) is an ideal of R, then t(C(x)) = C is a o-cyclic subspace of R”. 
Conversely, if C C R” is a @-cyclic subspace, then for any k > 1, we have H*c € C 


whenever c € C, it implies 


Ye(x) € C(x) > x*c(x) € C(x), O0<k<n-l, 


which means that C(x) is an ideal of R. We complete the proof. 


By the above lemma, to find a @-cyclic subspace in R”, it is enough to find an 
ideal of R. There are two trivial ideals C(x) = 0 and C(x) = R, the corresponding 
o-cyclic subspace are C = 0 and C = R”. To find non-trivial @- ae subspaces, we 
make use of the homomorphism theorems, which is a standard technique in algebra. 
Let x be the natural homomorphism from R[x] to R, kerm = $(x)R[x]. We write 
o(x)R[x] by < (x) >. Let N be an ideal of R[x] satisfying 

< $x) >C N C Rix] —> R = Rix x]/<o(x)>. (5.3.2) 


Since R[x] is a principal ideal domain, then N =< g(x) > is a principal ideal gen- 
erated by a monic polynomial g(x) € R[x]. It is easy to see that 


< (x) >C< g(x) >> g(x) (x) in R[x]. 
It follows that all ideals N satisfying (5.3.2) are given by 
{< g(x) > | g(x) € R[x] is monic and g(x)|¢(x)}. 


We write by < g(x) > mod ¢(x), the image of < g(x) > under 7, i.e. 
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< g(x) > mod ġ (x) = x (< g(x) >). 
It is easy to check 


< g(x) > mod ġ (x) = {a(x)g(x) | a(x) € R[x] and dega (x) + degg (x) < n}. 
(5.3.3) 
more precisely, which is a representative elements set of < g(x) > mod ¢ (x). By 
homomorphism theorem in ring theory, all ideals of R given by 


{< g(x) > mod ¢(x) | g(x) € R[x] is monic and g(x)|¢(x)}. (5.3.4) 


Let d be the number of monic divisors of (x) in R[x], we have the following lemma. 


Lemma 5.3.2 The number of $-cyclic subspace of R” is d. 


Proof By lemma 5.3.1, the correspondence between ¢-cyclic subspace of R” and 
ideal of R is one-to-one. Based on (5.3.4), the number of ideal of R is equal to the 
number of divisors of ¢ (x) in R[x], i.e. d. So the number of -cyclic subspace of 
R” isd. 


Next, we discuss -cyclic lattice, which is the geometric analogy of cyclic code. 
The @-cyclic subspace of R” maybe regarded as the algebraic analogy of cyclic code. 
Let the quotient rings R and R given by (5.2.11). A R-module is an Abel group A 
such that there is an operator Aw € A for all A € Randa € A, satisfying 1 -œ =a 
and (A,A2)a = A, (A2a@). It is easy to see that R is a R-module, if A C R and A is 
a R-module, then A is called a R-submodule of R. All R-modules we discuss here 
are R-submodule of R. On the other hand, if J C R, then Z is an ideal of R, if and 
only if J is a R-module. Let œ € R, the cyclic R-module generated by a be defined 
by 

Ra = {ra |à € R}. (5.3.5) 


If there are finitely many polynomials œ1, @2,..., Œg in R such that 
A = Ra, + Raz +---+ Rag, 
then A is called a finitely generated R-module, which is a R-submodule of R. 
Now, if L C R” is a ġ-cyclic lattice, g € R”, H* (g) is the ideal matrix generated 
by vector g, and L(H*(g)) is the lattice generated by H* (g). In the following lemma, 
we prove that any L(H*(g)) is a @-cyclic lattice and 


g € L > L(H*(8)) CL, (5.3.6) 


which implies that L(H*(e)) is the smallest @-cyclic lattice of which contains vector 
g. Therefore, we call L(H*(g)) is a minimal ¢-cyclic lattice in R”. 


132 5 Cyclic Lattices and Ideal Lattices 


Lemma 5.3.3 For any vector g € R”, then L(H“*(g)) is a ġ-cyclic lattice. Moreover, 
if L C R” is a ¢-cyclic lattice and g € L, then we have L(H*(g)) C L. 


Proof Leta € H*(g), then there is an integer vector b € Z” such that a = H*(g)b. 
By lemma 5.2.2, we have 


a= gol,b+g,;Hb+---+ gn-1H"—'b 


and 
Hot = (gol, + 81H +++ + 8,1" ')Hb = H*(g)Hb. 


Since Hb € Z”, it follows that Ha € L(H*(g)). This means that L(H*(g)) is a ġ- 
cyclic lattice. If L is a @-cyclic lattice and g € L, then H*g € LforO0 <k <n—1, 


and 
bo 


bolag + bi Hg +---+bn,1H" 'g € L, forall b = . [eZ 


It follows that 
H*(b)g = H*(g)be L, be Z”. 


Thus we have L(H*(g)) C L, and lemma 5.3.3 holds. 


Lemma 5.3.4 There is a one-to-one correspondence between the minimal -cyclic 
lattice in R” and the cyclic R-submodule in R, namely 


t(Rg(x)) = L(H*(g)), forall g(x) € R 


and 
t!(L(A*(g))) = Rg(x), forall g € R". 


Proof Let b(x) € R, by lemma 5.2.5, we have 

t(b(x)g(x)) = H*(b)g = H*(g)b € L(H*(g)), 
and t(Rg(x)) C L(A*(g)). Conversely, if a € L(H*(g)), and a = H*(g)b for 
some integer vector b, by lemma 5.2.5 again, we have b(x)g(x) € Rg(x), and 
t (b(x)g(x)) = a. This implies that 


L(H*(g)) C t(Rg(x)), 


and 
t(Rg(x)) = L(A*(g)). 


The lemma follows immediately. 
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Suppose L = L(ß1, fo,..., Bm) is arbitrary -cyclic lattice, where B = [£;, 


b2, ---, Bmlnxm is the generated matrix of L. L may be expressed as the sum of 
finitely many minimal -cyclic lattices, in fact, we have 


L = L(H*(6))) + L(A*(B2)) + +++ + L(H* (Bm)). (5.3.7) 


To state and prove our main results, first, we give a definition of prime spot in R”. 


Definition 5.3.2 Let g € R”, and g(x) = t~! (g) € R. If (g(x), o(x)) = 1 in R[x], 
we call g is a prime spot of R”. 

By (iv) of lemma 5.2.4, g € R” is a prime spot if and only if H* (g) is an invertible 
matrix, thus the minimal -cyclic lattice L(H*(g)) generated by a prime spot is a 
full-rank lattice. 


Lemma 5.3.5 Let g and f be two prime spots of R", then L(H*(g)) + L(A*(f)) 
is a full-rank @-cyclic lattice. 


Proof According to lemma 5.1.4, it is sufficient to show that 
rank(L(H*(g)) N L(H*(f))) = rank(L(H*(g))) =n. (5.3.8) 
In fact, we should prove in general 
L(H*(g)- H*(f)) C L(A*(g)) 0 LOR* (P)). (5.3.9) 
If (5.3.9) holds, since H* (g) - H*(f) is invertible matrix, then 
rank(L(H*(g)- H*(f))) =n, 
(5.3.8) holds. To prove (5.3.9), we note that 
L(H"(g)- H"(f)) = L(H* (8 * f)), 


It follows that 
t! (L(H* (8) < H*(f))) = Rœ) f(x), 


It is easy to see that 
Rg(x) f(x) C Rg) ORF). 


Therefore, we have 


L(H* (8) - H*(f)) = t(Rg@)f)) C L(A*(g)) N L(A*(f)). 


This is the proof of lemma 5.3.5. 
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It is worth to note that (5.3.9) is true for more general case and does not need the 
condition of prime spot. We have the following lemma. 


Lemma 5.3.6 Let b1, 62,..., Bm be arbitrary m vectors in R”, then we have 


L(H* (61) H* (B2) +++ A*(Bm)) C LCH*(B1)) A L(H* (B2)) A -++ O L(H* (Bm). 
(5.3.10) 


Proof If 61, b2, ..., Bm are integer vectors, then (5.3.10) is trivial. For the general 
case, we write 


L(A*(B,) - H* (B2) - -© H* (Bm)) = L(H* (B1 * Bo * +- + * Bm), 
where f1 * Bo * --- * Bm is the @-convolutional product defined in (5.2.14), then 
t7! (L(H* (B1) +++ H* (Bm))) = RBi (x) B2(x) ++ + Bn (x). 


Since 


RP (x) pax) ++ Bm) C RB) NA RA) +O Rpm), 


It follows that 


L(H* (b1) H* (B2) +++ H* (Bm)) C L(H*(B1)) A L(H* (Bo)) A -++ O L(H* (Bm)). 


We have this lemma. 


By lemma 5.3.5, we also have the following corollary. 


Corollary 5.3.1 Let 6), B2, ..., Bm be m prime spots of R", then L(H*(B,)) + 
L(A*(B2)) +--+ + L(H*(Bm)) is a full-rank ġ-cyclic lattice. 


Proof Based on lemma 5.1.5, it follows immediately from lemma 5.3.5. 


Our main result in this paper is to establish the following one-to-one correspon- 
dence between @¢-cyclic lattices in R” and finitely generated R-modules in R. 


Theorem 5.3.1 Let A = Ræ (x) + Raz(x) + --- + Ram (x) be a finitely generated 
R-module in R, then t(A) is a @-cyclic lattice in R". Conversely, if L C R” is a ġ- 
cyclic lattice in R", then t~} (L) is a finitely generated R-module in R, that is a 
one-to-one correspondence. 


Proof If A is a finitely generated R-module, by lemma 5.3.4, we have 


t(A) = t(Ray(x) + -+ Rom (x)) 
= L(H* (œ1)) + L(H*(a@2)) + +--+ L(A" (Gm). 


The main difficult is to show that ¢ (A) is a lattice of R” , we require a surgery to embed 
t(A) into a full-rank lattice. To do this, let (œ; (x), @(x)) = di (x), di (x) € Z[x], and 
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B(x) = ai (x)/di(x), 1 <i < m. Since ¢(x) has no multiple roots by assumption, 
then (£: (x), $ (x)) = 1 in R[x]. In other words, each t (£; (x)) = £; is a prime spot. 
It is easy to verify Ra; (x) C R6;(x) (1 < i < m), thus we have 


t(A) C L(H*(B1)) + L(H*(B2)) +-+- + LCA" (Bm)). 


By corollary 5.3.1, we have t(A) is ¢-cyclic lattice. Conversely, if L C R” is a 
ġ-cyclic lattice of R”, and L = L (£1, Bo, ..., Bm), by (5.3.7), we have 


t'(L) = RB\(x) + RBo(x) +- + RBn (x), 


which is a finitely generated R-module in R. We complete the proof of theorem 5.3.1. 


Since R is a Noether ring, then J C R is an ideal if and only if Z is a finitely 
generated R-module. On the other hand, if J C R is an ideal, then t(/) C Z” isa 
discrete subgroup of Z”, thus t (J) is a lattice. We give the following definition. 


Definition 5.3.3 Let J C R be an ideal, t(/) is called the ¢-ideal lattice. 

Ideal lattice was first appeared in Lyubashevsky and Micciancio (2006), and more 
contents could be found in Zheng et al. (2022a). As a direct consequence of theorem 
5.3.1, we have the following corollary. 


Corollary 5.3.2 Let L C R” be a subset, then L is a ¢-cyclic lattice if and only if 
L = L(H*(B1)) + L(A" (b2)) +--+ + L(H* (Bm)), 


where Pi € R” and m <n. Furthermore, L is a ġ-ideal lattice if and only if every 
Bi € Z", 1<i<m. 


Corollary 5.3.3 Suppose that $(x) is an irreducible polynomial in Z[x], then any 
nonzero ideal I of R defines a full-rank ġ-ideal lattice t (I) C Z”. 


Proof Let I C R be a nonzero ideal, then we have J = Rai (x) + Ræz(x) +--+ + 
Ræm(x), where œ; (x) € R and (œ; (x), @(x)) = 1. It follows that 


t(1) = L(H* (œ1)) + L(H* (@2)) + +++ + L(H* (Gn). 


Since each a; is a prime spot, we have rank(t(/)) = n by corollary 5.3.1, and the 
corollary follows at once. 


We have proved that any an ideal of R corresponding to a ¢-ideal lattice, which 
just is a ġ-cyclic integer lattice under the more general rotation matrix H = Hg. 
Cyclic lattice and ideal lattice were introduced in Lyubashevsky and Micciancio 
(2006) and Micciancio (2002), respectively, to improve the space complexity of 
lattice-based cryptosystems. Ideal lattices allow to represent a lattice using only two 
polynomials. Using such lattices, class lattice-based cryptosystems can diminish 
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their space complexity from O(n?) to O(n). Ideal lattices also allow to accelerate 
computations using the polynomial structure. The original structure of Micciancio’s 
matrices uses the ordinary circulant matrices and allows for an interpretation in terms 
of arithmetic in polynomial ring Z[x]/ < x” — 1 >. Lyubashevsky and Micciancio 
latter suggested to change the ring to Z[x]/ < (x) > with an irreducible (x) 
over Z[x]. Our results here suggest to change the ring to Z[x]/ < @(x) > with 
any a polynomial (x). There are many works subsequent to Lyubashevsky and 
Micciancio, such as Micciancio and Regev (2009); Peikert (2016). 


Example 5.1 It is interesting to find some examples of -cyclic lattices in an alge- 
braic number field K. Let Q be rational number field, without loss of generality, an 
algebraic number field K of degree n is just K = Q(w), where w = w; is a root of 
(x). If all Q(w;) C R (1 <i < n), then K is called a totally real algebraic number 
field. Let Ox be the ring of algebraic integers of K, and J C Ox be an ideal, J 4 0. 
Since there is an integral basis {œ1, @2,...,@,} C Z such that 


I = Za, + Za +--+ Zan, 


We may regard every ideal of Ox as a lattice in Q”, our assertion is that every nonzero 
ideal of Ox is corresponding to a full-rank ¢-cyclic lattice of Q”. To see this example, 


let T 
Qiw] = [Saw |a; <o). 
i=0 


It is known that K = Q[w], thus every œ € K corresponds to a vector a € Q” by 


Qn-1 


If I C Ox is an ideal of Og and J = Za; + Zæ +--+ Zan, let B = [ay, 
@2,..., A] E Q”*”, which is full-rank matrix. We have t(J) = L(B) is a full- 
rank lattice. It remains to show that t(/) is a -cyclic lattice, we only prove that 
ifa € I > Ha € (J). Suppose that œ € J, then wa € J. It is easy to verify that 
T(w) = e; and 

T(wa) = T(w) * T(a) = Hae rt(I). 


This means that t(/) is a @-cyclic lattice of Q”, which is a full-rank lattice. 
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5.4 Improved Upper Bound for Smoothing Parameter 


As application of the algebraic structure of -cyclic lattice, we show that an explicit 
upper bound of the smoothing parameter for the ¢-cyclic lattices. The definition of 
smoothing parameter was introduced in Chap. 1. Suppose that L is a full-rank lattice 
and L* is its dual lattice, for any € > 0, we define the smoothing parameter 7, (L) of 
L to be the smallest s such that »;/;(L*) < 1 + €, here p is the Gauss function, 


Slx—el? 


Ps,c(x) =e » Ps(X) = Pso(x), x € R”. 


Notice that p1/s(L*) is a continuous and strictly decreasing function of s, thus the 
smoothing parameter 7, (L) is a continuous and strictly decreasing function of e, i.e. 


Ne (L) S He (L), if0 < e < eé. 


The following lemma shows the relation of smoothing parameters between a lattice 
and its sublattice. 


Lemma 5.4.1 Suppose that L, and L3 are two full-rank lattices in R”, and L, C Lo, 
then for any € > 0, we have 
Ne(L2) S ne(L1). (5.4.1) 


Proof Let ne(L1) = s, we are to show that ne(L2) < s. Since 
piss (L) =1 +e, 
i.e. 
Soe mite. 


xeLt 


It is easy to check that L3 C Lj, it follows that 


l+e = X ented? > X ents xl? 
—_ a ’ 


xeLi xeL3 


which implies 
Pijs(L3) <1 +e, 


and ne(L2) < s = ne(L1), thus we have lemma 5.4.1. 


According to (5.2.4), the ideal matrix H*(f) with input vector f € R” is just the 
ordinary circulant matrix when ¢ (x) = x” — 1. Next lemma shows that the transpose 
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80 
81 
of a circulant matrix is still a circulant matrix. For any g = : € R”, we denote 
8n-1 
8n-1 
8n-2 
g= . |, which is called the conjugation of g. 
&0 
80 
81 
Lemma 5.4.2 Let (x) = x” — 1, then for any g = . €e R”, we have 
8n-1 
(H*(g))" = H* (H3). (5.4.2) 


Proof Since (x) = x” — 1, then H = Hg is an orthogonal matrix, and we have 
H`! =H"! = H". We write Hı = H” = H™'. The following identity is easy to 
verify 

=T 

g Hı 

: g H? 
H*(8) = : 

aH} 
It follows that 


(H*(g))’ = (Hg, H(H@),..., H" '(Hg)] = H*(HẸ), 


and we have the lemma. 


Lemma 5.4.3 Let (x) = x” — 1, suppose that g € R” and the circulant matrix 
H* (g) is invertible. Let A = (H*(g))’ H* (g), then all characteristic values of A are 
given by 

{lg@)I?, 1801, <- 1¢@n I", 


where 6? = 1 (1 <i < n) are the n-th roots of unity. 
Proof By lemma 5.4.2 and (ii) of lemma 5.2.4, we have 


A = H*(Hg)H*g = H*(H*(H2)g) = H*(g"), 
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where g” = H*(H@)g. Let g” (x) = t~!(g”) is the corresponding polynomial of g”. 
By lemma 5.2.3, all characteristic values of A are given by 


{g"(1), 8" (02),---8"(On)}, OF =1, L<i<n. 


&0 
&1 : 

Let g = . € R”. It is easy to see that 

&n-1 
n—-1 n—-1 n—-1 
s(@)= og + (x ans) x+ (x T x"! = gol, 

i=0 i=0 i=0 

where g_; = gn—i for all 1 < i < n — 1, then the lemma follows at once. 


By the definition of prime spot, if g € R” is a prime spot, then there is a unique 
polynomial u(x) € R such that u(x)g(x) = 1 (mod ¢(x)). We define a new vector 
T, and its corresponding polynomial T, (x) by 


T; = Hū, T(x) = (HT). (5.4.3) 


If g € Z” is an integer vector, then T, € Z” is also an integer vector, and T, (x) € Z[x] 
is a polynomial with integer coefficients. Our main result on smoothing parameter 
is the following theorem. 


Theorem 5.4.1 Let (x) = x" — 1, L C R” be a full-rank -cyclic lattice, then for 
any prime spots g € L, we have 


no= (L) < vn (min{|T 1), ITa (2), «+. IT (0D, (5.4.4) 


where 6? = 1, 1 <i < n, and T, (x) is given by (5.4.3). 


Proof Let g € L be a prime spot, by lemma 5.4.1, we have 
L(H*(8)) C L = ne(L) < ne(L(H*(8))), Ve > 0. 


To estimate the smoothing parameter of L(H*(g)), the dual lattice of L(H*(g)) is 
given by 


L(H*(g))* = L(H*(u))") = L(A*(H)) = L(A*(T,)), 


where u(x) € R and u(x)g(x) = 1 (mod x” — 1), and T, is given by (5.4.3). Let 
A= ry a by lemma 5.4.3, all characteristic values of A are 


{T (1) 17, IT (02) 17, -- +5 [Te (On)17}- 
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By lemma 5.1.2, the minimum distance 4;(L(H*(g))*) is bounded by 

Ai (L(H*(g))*) > min{|T, (61)|, |T,(2)|, --- IT (On) }- (5.4.5) 
According to the classical estimation of upper bound of smoothing parameter 


no-n(L) < Vn/Ai(L*), 


we see that theorem 5.4.1 holds. 


Let L = L(B) be a full-rank lattice and B = [£1, Bo, ..., n]. We denote by 
B* = [BY, B5,..., B3] the Gram-Schmidt orthogonal vectors {6*} of the ordered 
basis B = {f;}. It is a well-known conclusion that 


> |B*| = mi * 
Ai(L) > |B" ee ll 


and 


No-n(L) < J/n/A(L*), 
so we get the following upper bound 
m= (L) < Jnl Be|-!, (5.4.6) 


where Bo is the orthogonal basis of dual lattice L* of L. 
For a ¢-cyclic lattice L, we observe that the upper bound (5.4.5) is always better 
than (5.4.6) by numerical testing, we give two examples here. 


Example 5.2 Letn = 3 and ¢ (x) = x? — 1, the rotation matrix H is 


001 
H=1{100 
010 


We select a ġ-cyclic lattice L = L(B), where 


111 
B=|011 
001 


Since L = Z?, thus L is a -cyclic lattice. It is easy to check 


V3 
|Bo| min, |; 3 
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On the other hand, we randomly find a prime spot 


and g(x) = x”, since 
xg(x) = 1 (mod x? — 1), 


we have 
T(x) = x’, 


it follows that 
|T; (01)| = |T (@2)| = |T; (83) = 1, 


—l 
; : < *j=l _ f 
(,min, 7.1) < |Bij! = V3 


Example 5.3 Letn = 4 and $(x) = x* — 1, the rotation matrix H is 


0001 
1000 
0100 
0010 


H = 


We select a ġ-cyclic lattice L = L(B), where 


1111 
0111 
0011 
0001 


Since L = Zf, thus L is a -cyclic lattice. It is easy to check 


|Bo| = min |£ř| = : 
OS tere i JA 


On the other hand, we randomly find a prime spot 
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and g(x) = x — 2, since 


we have 


it follows that 
5 
|T,(A1)| = 1, |T; (82)| = |T; (63) | = |T; (84)| = 7 


and 


min |T,(6;)| ay i 
1<i<4 gi 5 0 s 


Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 
International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, 
adaptation, distribution and reproduction in any medium or format, as long as you give appropriate 
credit to the original author(s) and the source, provide a link to the Creative Commons license and 
indicate if changes were made. 

The images or other third party material in this chapter are included in the chapter’s Creative 
Commons license, unless indicated otherwise in a credit line to the material. If material is not 
included in the chapter’s Creative Commons license and your intended use is not permitted by 
statutory regulation or exceeds the permitted use, you will need to obtain permission directly from 
the copyright holder. 


Chapter 6 A) 
Fully Homomorphic Encryption cepel 


In 1978, Rivest et al. (1978) proposed the concepts of data bank and fully homo- 
morphic encryption. Some individuals and organizations encrypt the original data 
and store them in the data bank for privacy protection. Data bank is also called data 
cloud. Therefore, the cloud stores a large amount of original data, which is obvi- 
ously a huge wealth. How to use these data effectively? First of all, we must solve 
the problem of calculation of these encrypted data, which is called a privacy calcu- 
lation problem. Rivest, Adleman and Dertouzos conjecture that if all data is fully 
homomorphic encryption, that is, the addition and multiplication of ciphertext are 
homomorphic to the corresponding addition and multiplication of plaintext, then the 
encrypted data can be effectively computed by elementary calculation without chang- 
ing the structure of the plaintext data (under the condition of homomorphism). The 
RAD conjecture has been proposed for more than 30 years, but no one could solve 
this problem since the cryptographic structure of the fully homomorphic encryption 
system is too complicated. In 2009, C. Gentry, a computer scholar at Stanford Uni- 
versity, first proposed a fully homomorphic encryption scheme in Gentry (2009b) 
based on ideal lattice, for which he won the 2022 highest award in theoretical com- 
puter science—the Godel Award. Based on Gentry’s work, the second and third fully 
homomorphic encryption schemes based on LWE distribution and trapdoor matrix 
technology have also been proposed; see Brakerski and Vaikuntanathan (201 1a), 
(201 1b), (2012), (2014), (2015) and Gentry et al. (2013) in 2013. The main purpose 
of this chapter is to systematically analyze and discuss the above three fully homo- 
morphic encryption techniques, in order to understand the latest research trends of 
the post-quantum cryptography. 
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6.1 Definitions and Examples 


Let R; be the plaintext space, R2 be the ciphertext space, R be the keyspace. For 
SER, 


=] 
Ri —&> R — R, eR: 


we call f, the encryption function under the key s, and f7! is called the decryption 
function. In mathematical cryptosystem, f, is injective so that f7! is the left inverse 
mapping of fs, i.e. f! fs = 1r,, which guarantees decrypting plaintext successfully 
with probability 100%. However, in probabilistic cryptosystem, fs is not an injective 
mapping, while the probability of f—' being a left inverse mapping should be close 
enough to 1, ie. 

Pri fo! fs = 1r} > 1-6, Yô > 0. 


Hash function is a classic probabilistic cryptosystem. The phenomenon that two 
plaintexts are encrypted into the same ciphertext, in other words, one ciphertext 
could be decrypted into two plaintexts, is called a collision. If the probability of 
collision is small enough, then it is called an anti-collision Hash function. The cryp- 
tosystem constructed by the anti-collision Hash function is the mainstream algorithm 
of probabilistic cryptography. No matter mathematical or probabilistic cryptosystem, 
we treat the decryption transformation f~! as the left inverse mapping of f,, but it 
is only an equality with high probability. 

=i 
Definition 6.1.1 Let R, i > Ro f > R4, R be the keyspace, s € R, suppose 
R, and R; are additive groups. 


1. If there is s € R such that 
Fea +02) = f la) + A'e), Wer, c € Ro, (6.1.1) 


we call f, the additive homomorphic encryption function. 
2. If ‘multiplication’ is defined in R, and Ro, and there is s € R such that 


Fz leaca) = f c) + file), Yei, c2 € Ra, (6.1.2) 


we call f, the multiplicative homomorphic encryption function, where s* is the 
corresponding key of s under multiplication. 

3. If fs is both additive and multiplicative homomorphic encryption function, then 
fs is called the fully homomorphic encryption function. 


Remark 6.1.1 The multiplication defined in the ciphertext space Rz is not closed, 
i.e. there are cj, C2 € Ro, cıc2 ¢ R2. We denote the result of the multiplication as 
R> ® Ro, Le. 

Yci, c2 E Ro > c1- C2 € Ro @ Ro, 


then the corresponding key in R2 ® R2 is s* = s Q s. 
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Remark 6.1.2 By (6.1.1), f '(cı +c2) is the plaintext u corresponding to the 
ciphertext cı + c2, fo (cy) and f'ca) are the plaintexts u, u2 corresponding 
to the ciphertexts cı and c2. (6.1.1) is equivalent to: 


AG + c2) = u = u + u2, 


that is, ciphertext addition is homomorphic to plaintext addition, so is multiplica- 
tion homomorphism. If f, is fully homomorphic encryption, then we can perform 
polynomial calculations and rational function calculations on ciphertexts. By Taylor 
expansion, any elementary operation (exponential function, logarithmic function, 
trigonometric function, etc.) can be approximated by polynomials. Therefore, for 
fully homomorphic encrypted data c, we can do any elementary operation without 
changing the structure of the plaintext. 
We give a few examples to further understand the Definition 6.1.1. 


Example 6.1 Homogeneous Affine Hill Cryptosystem (see Chap. 4, Sect. 4.7 in 
Zheng 2022) is additive homomorphic encryption. 

Letq > 1 beapositive integer, Z4 be the residue class ring mod q, A € Z;*" be an 
invertible n dimensional matrix. The Homogeneous Affine Hill encryption function 
is fa: Ym € Z} is a plaintext, then 


c= fa(m) = A-me Zi» c is the ciphertext, 


it follows that i © = A~'c = m. For any C1, C2 € Zp we have 


fx (Ci + e2) = A~! (c1 + c2) = A~e + Aez = fae) + fa (2), 
so fa is additive homomorphic encryption. 


Example 6.2 The public key cryptography RSA (see Chap. 4, Sect. 4.7 in Zheng 
2022) is multiplicative homomorphic encryption. 

Let n > 1 be the product of two prime numbers, (n) be the Euler function, 
1 <e < y(n), (e, p(n)) = 1, e be the public key, d = e7! mod y(n), 1 < d < y(n), 
d be the private key, i.e. 


ed = 1 (mod g(n)), 1< d < g(n). 
We define the encryption function of RSA fe : Z, —> Z, which is a one-to-one 
correspondence, 


c= fe(m) = m° (mod n), Ym € Zp, 


the decryption function is 
F'O = cÀ (mod n). 


146 6 Fully Homomorphic Encryption 
Obviously, for any two ciphertexts c1, c2 € Zn, it follows that 


fo‘ (c1€2) = (C102)? (mod n) 


= c! . cf (mod n) 


= f(c) f7 (c2) (mod n). 


Thus, we have f7 !(c1c2) = f7 ' (c1) - f7! (c2) in Zn, and we confirm that RSA is 
multiplicative homomorphic encryption. 


Based on Examples 6.1 and 6.2, to construct a fully homomorphic encryption 
system, which is essentially a ring homomorphism between two rings in algebra, 
let’s look at the following Example 6.3 first. 


Example 6.3 Let Rı and R, be two commutative rings, encryption function f : 
R, — R, bea single ring homomorphism. The f is fully homomorphic encryption. 

In fact, since f is a single homomorphism and R; is the plaintext space, then 
F(Ri) C R is a subring of Ro, that is, the plaintext space is embedded into the 
ciphertext space. Let c1, c2 € R be any two ciphertexts, there exist u1, u2 € Ri > 
f(u) = c1, f (u2) = co, thus, 


fci + c2) = f (f u) + f (u)) 
= f! (f (u +u2)) = ui +u = fc) + f'e). 


Similarly, 
fica) = FS u) + f) 


= f7 (f uiu)) = ui -u = fe) f7 e). 
Hence, f is fully homomorphic encryption. 


Next, we use the Chinese Remainder Theorem to construct an example of fully 
homomorphic encryption. 


Example 6.4 Let N = nın ...ng, where {n;} are mutually coprime positive inte- 
gers. Denote the plaintext spaces R; and R3 as 


Rı = Zn, ® Zn, a -D Zn R2 = Zn, 


here R; is the direct sum of k rings Z,,. Leta = (a1, a2, ..., ax) € R; be a plaintext, 
based on the Chinese Remainder Theorem, there is only one x € Zy such that 


x =a; (mod n;i), 1Ki <k. 
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We define the encryption function f : Rj —> Rz as f(a) = x. Now we prove that f 
is fully homomorphic encryption. Let f(a) = x1, f(b) = x2, then 


xı +x. =a, + bi (mod ni), Vi = 12s og Ke 


So we have f i i 
f Gi t%x2)=atb= fi) + f G2). 
Similarly, 
Xx. = aib; (mod ni), Vi = 1, 2, TE k. 
Therefore, 


fF) =a- b = fi) FG). 


This means that f is fully homomorphic encryption. By Chinese Remainder The- 
orem, the computing complexity of x is O(klog* N), we have the simplest fully 
homomorphic encryption in this example. 


From Example 6.4, it can be seen that it is not difficult to construct symmetric 
fully homomorphic encryption, but the data bank envisaged by Rivest, Adleman and 
Dertouzos are all data encrypted by public key cryptography. So RAD conjecture is to 
construct an asymmetric fully homomorphic encryption system. When the encryption 
key and the decryption key are separated, it becomes a very difficult work to satisfy 
the fully homomorphic property. The work of Gentry in 2009 or later only solve part 
of the RAD conjecture. They can construct a fully homomorphic encryption system 
under a bounded condition, while under the unbounded condition, the RAD problem 
is still an unsolved open problem. 

Fully homomorphic encryption is similar to ring homomorphism. When construct- 
ing an asymmetric fully homomorphic encryption system, because the problem is too 
difficult, Gentry decomposed the decryption transformation into a composite of two 
mappings in Gentry (2010). The fully homomorphic properties are discussed sep- 
arately for each composite factor, thus forming the current technology of bounded 
fully homomorphic encryption. 


Fs Te te 
Let R; BLA R — R; be acryptosystem, assume that R; is a ring. Decompose 
fo! into Ry Š R3 S R}, where R3 is a ring, f7! = o o 01. If both o; and op are 
homomorphism of rings, then 


Fea + c2) = on(o1 (c1 + €2)) = o2 (01 (c1) + 01 (c2)) 
= 0201 (c1) + 201 (62) = F ' (c1) + F (c2). 


Definition 6.1.2 Under the above assumptions, if there is a set M such that 


1. If f7 (c1) + f7! (c2) € M N R, then 


K'a te) = fo (a + eo). 
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2. If f7! (c1) - f7! (c2) € M N R3, then 
fæ ie) = f (er) fy (ea). 


Generally, a bounded fully homomorphic can only perform a finite number of homo- 
morphic calculations. Because after repeated addition and multiplication of the 
ciphertext, the corresponding plaintext may run out of the boundary, so the homo- 
morphic property cannot be guaranteed. 


6.2 Gadget Matrix and Gadget Technique 


Gadget technique is developed from the work of Ajtai in 1999 (Ajtai, 1999), see 
Agrawal et al. (2010), Alperin-Sheriff and Peikert (2013), Alwen and Peikert (2009), 
Peikert and Waters (2008) and which plays an important role in bounded fully homo- 
morphic encryption. To better understand gadget matrix and gadget technique, we 
start with the classical short integer solution problem (SIS). 

Let A € Z” be a given n x m dimensional matrix, u € Z% be the target vector. 
Find the shortest integer vector x € Z7 such that 


Ax = u (mod q), |x| < £. (6.2.1) 


The shortest integer solution x in (6.2.1) is actually the shortest vector in the following 
q ary lattice 
L (A) ={xe Zi | Ax = u (mod q)} U qZ (6.2.2) 

which is the general form of the SIS problem. If u = 0, the above problem becomes 
the classic SIS problem. For general matrix A, the SIS problem is difficult, but for 
some special matrices, such as the gadget matrix we will introduce later, the exact 
shortest integer solution is easy to find. 

We begin from n = 1, if A is an/ dimensional row vector (1 x / dimensional 
matrix), where / = [log,q], i.e. l is the largest integer such that 2⁄7! < q < 2', let 


g=| 4 Jez. (6.2.3) 
zi- 
Lemma 6.2.1 Let A = g' be anl dimensional vector, then the shortest vector in the q 


ary lattice L} (g') could be accurately calculated. Suppose the binary representation 
ofu € Z4 is 
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u = (am...) >=] . Je Li (g’) (6.2.4) 
aj—| 


is the shortest vector. In other words, the smallest integer solution of g'x = u (mod q) 
isx =a. 


Proof u € Z,,0 <u < q, since 2'-! < q <2!', u could be represented as 
u = ao + a1 eee ee ae a; =Oorl. 
Based on the definition of g in (6.2.3) and the definition of «œ in (6.2.4), we have 


g'a = u, it follows that a is the smallest integer solution of g’x = 0 (mod q). Lemma 
2.1 holds. 


The gadget vector defined by (6.2.3) can also be used as a sample of the one 
dimensional LWE distribution, so that the solution of the LWE distribution can be 
by 


bz 
easily solved. Let A = g’ € La b=] .]¢é Z}, we get the LWE;:,4,x,ı problem 


(see Definition 3.3.3 in Chap. 3) 


bi =, 2's; +e; (mod q), e = | xs I <i<L 
el 


If the LWE distribution A, , = (i, b) is given, we can get the following relations 
with high probability l 
si =, 2'b; (mod q), 1 <i <i. 


In order to generalize the above gadget technique to high dimensions, i.e. n > 1, 
we need to replace the gadget vector g defined in (6.2.3) with the gadget matrix. 
Let A = (aij)nixnm> B = (bij)mixm» the Kronecker product A @ B (see Chap. 2 in 
Zheng 2022) of the matrices A and B is defined as 


ayı B ay B KEN ain, B 


azn B an B seers an, B 
A@B= . , ; : (6.2.5) 


ani B an, 2B nae Ann, B nym Xngmy 
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Definition 6.2.1 Assume n > 1, J, is the n dimensional identity matrix. We define 
the n x nl dimensional gadget matrix G as the following block diagonal matrix, 


G = I, B g' = diag{g', g’,...,g'} eZ", (6.2.6) 


where g is the gadget vector defined in (6.2.3). 


Lemma 6.2.2 Let G be a gadget matrix, u € Zi be the target vector. Then the short- 


est integer solution x € Zn of the SIS problem Gx = u (mod q) could be uniquely 
determined by lemma 2.1. 


uy 
Proof Letu = | : | € Z} bea given target vector, x be an nl dimensional column 


Uy 
vector divided into 


X=]. | where x; € Z, l<icn. 
Xn 


Based on the definition of gadget matrix G, the SIS problem Gx = u (mod q) is 
equivalent to the following n equations: 


gx; =u; (mod q), 1<i<n. 


By lemma 2.1, the shortest integer solution of each equation could be uniquely 
a 


a2 
determined as x; = a; € Z!, sox =| . | is the shortest integer solution of Gx = 


Xn 


u (mod q). 


=ý 
Definition 6.2.2 For any u € Zy» we define function: Zi £, Z" as G! (u) =x, 
where x € Z” is the shortest integer solution of Gx = u (mod q). 


Lemma 6.2.2 guarantees the existence of the function G~! and gives the way to 
compute the vector x. By Definition 6.2.2, we have 


GG~'(u) = u (mod q), (6.2.7) 


the above function G~! : L Z"! could be regarded as the ‘inverse’ matrix of the 
gadget matrix G. 
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When using the gadget matrix G as the LWE distribution sample to solve the 


S1 
S2 
LWE problem, notice that for any n dimensional vector s = | . | € Z% we have 
Sn 
s'G = (s18', 528", ..-45ng’) € ZY. (6.2.8) 


For the LWE distribution A, , = (G, b), where b € zy , to solve the private key s, 
ENE nl n 
b = sG, b € Z> seZi, 


based on (6.2.8), it can be transformed into n one dimensional LWE distribution 
problems, which has been discussed above. 

The solutions of the SIS problem and the LWE problem discussed above are easy 
to compute because these problems are based on specific gadget vectors and gadget 
matrices. To get more general results, we need the trapdoor matrix, the tag matrix 
(tag) and the Gauss matrix. An integer matrix R is called a Gauss matrix, if all of 
its components are independent and have the discrete Gauss distribution. Since the 
Gauss distribution has the greatest probability near 0, a random Gauss matrix is also 
called a short integer vector matrix in the sense of high probability. 


Definition 6.2.3 Let A € Zy” be a given matrix, R € Z"*"! be a Gauss matrix, 
H € Zy” be an invertible n dimensional square matrix, G € a be a gadget 
matrix, if 

AR = HG (mod q), (6.2.9) 


then we call R as the trapdoor matrix of A, and H is the tag matrix. 


Generally, A is called the check matrix, and R satisfying (6.2.9) is called the trapdoor 
matrix of the check matrix A with the tag H. To better understand the Definition 
6.2.2, by Lemma 6.2.2, the SIS problem generated by the gadget matrix G can be 
easily calculated. If H € Z)*” is an invertible matrix, then the SIS or LWE problems 
generated by HG are also easy to compute. In fact, for any target vector u € Z9”, 


HGx = u (mod q) & Gx = H~'u (mod q). 


The shortest integer solution of the SIS problem in the right hand is G-!(H~'u); 
therefore, the shortest integer solution of HGx = u (mod q) is x = G7! (H7!u), 
where the target vector is replaced by H~'u. We can discuss the LWE problem 
generated by HG in the same way. Next we generalize the results to a general 
matrix A. 


Lemma 6.2.3 For any check matrix A € Z”, the shortest integer solution of the 
SIS problem Ax = u (mod q) generated by A could be approximated as 
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x= Rw, whereew=G '(H'un), (6.2.10) 


R is the trapdoor matrix of A with tag H. 


Proof If the trapdoor matrix R of A exists, let x = Rw in the SIS problem 
Ax = u (mod q) (x € Z”, the target vector u € Z7) generated by A, where w € g", 
therefore, 

Ax = u (mod q) > ARw = u (mod q), 


we have 
HGw = u (mod q) > w = G`! (H` 'u). (6.2.11) 


Since w is the shortest integer solution of (6.2.11), and the trapdoor matrix R is 
a Gauss matrix, so x = Rw = RG! (H~ !u) is a short integer solution of the SIS 
problem generated by A, i.e. we can regard RG~'(H~'w) as an approximation of 
the SIS problem. 


To quantify the efficiency of the approximation of (6.2.10), we define the mass 
5,;(R) of the trapdoor matrix R 


sı(R)= max [RzI. (6.2.12) 
zez"! |z|=1 
By (6.2.10), 
|x| = |Rw| < sı(R)|w], (6.2.13) 


thus, the smaller sı (R) is, the shorter |x| is, and the approximation of the solution of 
the SIS problem is more accurate. So we can say that the smaller sı (R), the higher 
mass of the trapdoor matrix R. 

Finally, let’s discuss the generation of trapdoor matrix. For any uniformly dis- 
tributed random matrix A € LP suppose R € gxui is a Gauss matrix, let 


A =[A, HG -A R] € Z?”, m =m +nl, (6.2.14) 


where H € Zọ°” is a given invertible matrix, G is the gadget matrix. 


Lemma 6.2.4 If A is given by (6.2.14), then the trapdoor matrix of A with the tag 
H is 
R 


R= (; ) eZ" m=m+nl. (6.2.15) 


Proof From the definition of A and R 
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= HG (mod q), 


n 


so the trapdoor matrix of A with the tag H is (7). 


The mass sı(R) of the Gauss matrix R can be estimated using classical ran- 
dom matrix theory. The following result is referred from R.Vershynin’s monograph 
“Compressed Sensing, Theory and Applications’ Chap. 5, p. 210-268, Cambridge 
University Press, 2012. 


Lemma 6.2.5 Suppose R = (7) is given by (6.2.15), R is a Gauss matrix with 


parameter s in the Gauss distribution. Then we have the following relation with high 
probability 
sı(R) = O(s(V/m + vnl). 


Proof Based on the definition of trapdoor matrix, 


R 
sı(R)= max |Rz|= max | z| 
zeZ" |z|=1 zez" zj=1 | (In 


= ie |= = max y [|Rz|? + lzļ?, 
emi Iz E 1 zeZ" |zļ=1 


denote R = (r; j)mxnli, Where rj; has the discrete Gauss distribution with parameter 
s. By Chebyshev inequality, for any positive integer k, 


Weeer Ee d i=] 
Miz] S KSy ZL a = : 
1 k2s2 27 k2s2 Qn k2 


It follows that the probability of all the m - nl variables r;; satisfying |r;;| < ks is at 
least (1 — zE >)! We choose k large enough so that this probability is sufficiently 
close to 1, thus, 


nl 
si(R) = Pe | Rzl? + |z]? [Edt rp +1 
EZ” |\z|= 


Dd, 


<V1+mnlk2s? < Ks(/m+ vnl), 


where K = (k + 1)/ mal / (v/m + vnl), so we have 


Pr{s\(R) < Ks(/m + Vnl)} > (1 — inl 
Qn k2 
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i.e. in the sense of high probability 


sı(R) = O(s(V/m + vnl). 


6.3 Bounded Fully Homomorphic Encryption 


In 2009, C. Gentry of Stanford University in the USA first proposed a bounded fully 
homomorphic encryption based on ideal lattices, which has a great influence in the 
field of theoretical computer science, and a number of improved works have been 
proposed one after another. Brakerski and Vaikuntanathan proposed a fully homo- 
morphic encryption system based on the LWE cryptography in 2011 (see Brakerski 
& Vaikuntanathan, 2011a, 2011b, 2014, 2015), which we call BV fully homomor- 
phic encryption. Another improvement is the fully homomorphic encryption using 
trapdoor matrix proposed by Gentry, Sahai and Waters in 2013, which we call GSW 
fully homomorphic encryption. BV and GSW cryptosystems are currently the most 
active and cutting-edge research. The main purpose of this section is to introduce 
these two fully homomorphic encryption systems. 


1. BV fully homomorphic encryption 


Review the LWE cryptosystem by Regev introduced in Chap. 4. Let n > 2, q > 2, 
xX is a given distribution on Z4. The (n — 1) dimensional LWE distribution obtained 
by random sampling is (see Definition 3.3.2 in Chap. 3) 


i = @,b) € Z}! x Zy, 


b =,<a,s > +e (mod q), G31) 


where a € Zn! is uniformly distributed, 5 € Zn! is the randomly chosen private 
key, e € Z, has the distribution x. Generally, x is chosen as the discrete Gauss 
distribution on Z,. Let 


a= (5) € Zp s= (7) eZ; 


ais the public key and s is the private key. The key equality of the LWE cryptosystem 
(m = 1) encryption and decryption algorithm is: 


<a, s> = (-5’, 1) (7) 


= b<a,s> =, e (mod q), (6.3.2) 


e € Zq has the discrete Gauss distribution, and e is very close to 0 with high proba- 
bility, so it is also called the error term. 
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To better understand the fully homomorphic encryption technology based on the 
above LWE cryptosystem, we rewrite it into the form of symmetric encryption by 
formula (6.3.2). 


Most significant bit 


Let s € Z} be a private key, q > 2 be an odd number, u € Z, be the plaintext. The 
most significant bit of plaintext u by the LWE distribution A is c = f4(u), where 
ce Zi is the ciphertext, satisfying 


<s, C> Sy U 5 | (mod q), c € Z}, (6.3.3) 


where <s, c> is inner product. Equation (6.3.3) is not an exact congruence equation, 
but a congruence equation with error which has small probability. It should be noted 
that the encryption function f4 is only formal, and its specific algorithm depends on 
the samples of the LWE distribution (see Chap. 4). 

Using the private key s € Z7, the decryption of the ciphertext c is defined by 


{i O = |=. >| (mod q) 


=, |= Lu] (mod g) 
=, u(mod q) (see Lemma 3.3 in Chap. 4). (6.3.4) 


In order to better understand the fully homomorphic property (bounded) of the LWE 
cryptosystem, we write the most significant bit as the following equivalent least 
significant bit. 


Least significant bit 


Assume q > 2 is an odd number, let m = u (mod 2), and Z5 <mc< = u be a given 
plaintext u € Zp, i.e. 


m €{u+2Z}N(— 35,5]. (6.3.5) 


The least significant bit of u is fa (u) = c € Zj, where the ciphertext c satisfies 
<s,c> =m (mod q), (6.3.6) 


(6.3.6) is an exact congruence equation. 
The decryption of the ciphertext c still uses the private key s € Z}, which is 
divided into the following two steps: 


1. There exists only one m satisfying m = <s, c> (mod q), and -4 <m< 4. 
2. u = m (mod 2), then we get the plaintext i (c) =u. 
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We will prove that the most significant bit and the least significant bit are actually 
equivalent for multibit plaintext in the general case. First, we look at the difference 
between the two encryptions in the case of u € Z2. Write Eq. (6.3.3) in the error 
form, 


<s,c> =et+u 5] (mod q), 


then 


fi o= Fa + u (mod q). 


For a real number x, |x] = 0 & —5 <x< F, so =i <e< 1. Compared with 


(4.1.7) in Chap. 4, the decryption of the Regev’s cryptosystem is actually Eq. (6.3.4) 
here. This observation enables us to construct corresponding cryptosystem for multi- 
bit plaintext. 

Let 1 < p < q be two positive integers, (p, q) = 1, Zp be the plaintext space, Z% 
be the ciphertext, s € Z% be the randomly chosen private key. 

Most significant bit: for a given plaintext u € Zp, we define the most significant 
bit of u as M (u) = w € Z, satisfying 


Fa = u (mod p), (6.3.7) 


in fact, based on w = <s, c>, we can write the ciphertext as, 
_|4 
Mi) =w= Fa (mod q), (6.3.8) 
P 


the decryption function 


M'(w)= Fa =u (mod p), 


we can get the plaintext u. 
Least significant bit: the least significant bit for a given plaintext u € Z, is v, i.e. 
L(u) = v € GZ, satisfies 


v = e (mod q), e = u (mod p), = sea 


the decryption for the ciphertext v: there exists only one e € [ S 1) > v= 
e (mod q), let u =e (mod p), then M~'(v) = u. In fact the v here is <s, c>. 


Lemma 6.3.1 Jf 1 < p <q, (p,q) = 1, then the most significant bit and the least 
significant bit are equivalent. 
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Proof Since (p, q) = 1, then there are integers cp € Z, cg € Z => 
Cyp-P+Cg-qeal. 


Actually cp is the multiplicative inverse of p under mod q, c, is the multiplicative 
inverse of q under mod p. Denote cp = p~! and Cq = gt 
Assume v € Zz is the least significant bit of the plaintext u € Zp, i.e. L(u) = v. 
We are to prove that the most significant bit of the plaintext —q~'u € Z p 1S p ive 
Zq» i.e. 
M(—q"'u) = pv. 


Based on v = e (mod q), e € {u + pZ} N[—§, 4), so we have 


pe 
=p vIi= aay a 
q q P 
e 
= gq! 


= —_,-1 
=—-cye=—q 


u (mod p), 


this means M(—q"'u) = pty: On the other hand, if w = M (u), i.e. w is the most 
significant bit of the plaintext u, we confirm that the least significant bit of —qu is 
just pw € Z4, ie. 

L(—qu) = pw € Z4, 


by the definition of the most significant bit, 


ka = Pw r =u (mod p), 
q 


5 <r < 4, so (since (p, q) = 1) 


where — 
pw — qr = qu (mod p). 


Let qr = e, we get 
pw — e = qu (mod pq), 5 <e< z 


it follows that pw = e (mod q), and e = —qu (mod p), namely L(—qu) = pw. 

Above all, there is a one-to-one correspondence between the most significant 
bit and the least significant bit for a plaintext, so the two forms of encryption are 
equivalent. 
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Finally, we discuss the fully homomorphic property of the BV encryption system, 
which is summarized in the following theorem. 


Theorem 6.3.1 Let p = 2, q > 2 be an odd number, then the BV encryption system 
is bounded fully homomorphic encryption, and its fully homomorphic boundary is 


M=(-4,4]. 
22 


Proof Based on the least significant bit of the BV encryption system, its decryption 


function fra can be divided into two parts: R3 = Z4, Z4 iN Zə = R; is natural 
homomorphism, then f7! could be decomposed into 


Z — > MN Z, —> Z, 
where 0; is defined for any ciphertext c € Z”, c Z meEMN Zq satisfying 
<s, c> = m (mod q). 
Since there exists only one m satisfying the above formula, o; is well-defined. It 
follows that 
<S, C1 +02 >=< S, C1 > + < S, Q> 
= mı + m (mod q), (6.3.9) 
i.e. o1 (c1 + c2) = mı + m, ifm; + mz € M N Zq, then 
F (c1 + c2) = o2(01 (c1) + 01 (c2)) 
= o (m; + m) 


=u; + u2 (mod 2), 


so we have 
Fea + ce) = u +u = fola) fle), 


fs is additive fully homomorphic encryption. 

To introduce the multiplicative homomorphism, we define the Kronecker convolu- 
tion for two vectors in Zy Let cy = (C11, C12, ..., Cin) € Zp C2 = (C21, C22, ..-, C2n) 
E€ Zi be two row vectors, we define the Kronecker convolution of cı and c2 as cy ® c2, 


C1 ® C2 = (Cii + Caj)i<ij<n € a (6.3.10) 
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Obviously, for any four vectors a, b, c,d € Zi we have 
<a®b,c@®d> = <a, c>- <b, d>. (6.3.11) 


In fact, let a = (aj, &2,..., an), b = (b1, bo, ..., bn), C= (c1, C2,..., Cn), d= 
(di, do, es dn), by (6.3.10), 


n 


<a®b,c®d>= SS abe, 


i=1 j=l 


n 


=| acO bjd; 
j=1 


i=l 
= <a, c> : <b, d>, 


thus, (6.3.11) holds. 

Letci, co € Zi be two ciphertexts, s € Zi be the private key, we define the multi- 
plication as Kronecker convolution in the ciphertext space Zi Suppose s* = s @s, 
then the decryption function Je is a mapping of Ze — Z2. Based on (6.3.11), we 
have 

<S Q S, C1 @C2> = <S,Cj>+ <S, 02> 


= mı : m (mod q). 
If mymz € M N Zq, then 
mı = u; (mod 2), mz = uz (mod 2) > mımı = uuz (mod 2), 


namely 


f ci 8 ce) = K'a) fo'@), 


i.e. fs satisfies the multiplicative homomorphism. So we prove the bounded fully 
homomorphic property of the BV encryption system, and its fully homomorphic 


boundary is M = (—$, 4]. 


The above Theorem 6.3.1 can be generalized to the multibit case, that is, plaintext 
u € Zp, ciphertext c € Zg (p,q) = 1. Under these assumptions, the BV multibit 
fully homomorphic encryption system can be constructed, and we leave it as a ques- 
tion for the readers. Note that the dimensions of the ciphertext space and key space 
grow from n to n? by the Kronecker convolution. The dimension could be reduced 
by using the gadget technique in Sect. 6.2. This reduction technique is called key 
conversion. 
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Key conversion 


Let Cin = c1 Q Co be an nin dimensional ciphertext, where Cin and nin represent the 
input ciphertext and the dimension of the ciphertext. By the most significant bit of 
BV fully homomorphic encryption, then 


<Sin, Cin> = 8/y- Cin =y U É ] (mod q). (6.3.12) 


The above formula is obtained from (6.3.3), where Sin is the private key with dimen- 
sion Min. In order to reduce the dimension nin, we construct a private key Sout with 
lower dimension and convert the input ciphertext Cin into the output ciphertext Cout 
encrypted by Sout. Of course, the dimension Mout of the output ciphertext Cout and the 
key Sout is much smaller than the input dimension nin. To do this, let G be the gadget 
matrix, 

G = Inn @¢c, = diag{ci Cin} 


in? Cin Pag Nin xn? (6.3.13) 


G is the nin x n? a gadget matrix generated by the nin dimensional vector Cin. By 
(6.2.7) and (6.3. 12), we have 


<Sin, Cin> = sh + Cin = (84G) - G7" (Cin) Sy u E ] (mod 4), (6.3.14) 
where G~!(ci,) = x is the shortest integer solution of Gx = Cin (mod q). Based on 
(6.2.8), sf, -© G is an n2 dimensional vector. 


2 
Lemma 6.3.2 For anyn < nin, then there exist a matrix K € Ze and ann dimen- 
sional private key Soy with high probability such that 


-K =, Sn: G (mod q). (6.3.15) 


Sout 


Proof The construction of the matrix K and the transformed private key Sout are 
related to the resampling technique (Bootstrapping) of the LWE distribution. For a 


2 
given vector b’ = si G € Z we can take a sample Sou € Z% for very small error 


distribution e € Z4” (with high probability) and 
A = [ai, @, ..., anl, Yai € Zi 


satisfying (see 4.1.3 in Chap. 4) 


P A 
Soa m=) (7) =, e (mod q). 


Since e is a very small error term, the above equation can be written as the form of 
random congruence 
SoA =, b = si G (mod q). 


out 
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7 
nxn, 


Let K =A € Z; ", we have 


Sink = sh G (mod q). 


out 


Lemma 6.3.2 holds. 


Remark 6.3.1 K is the public key which could be made public, the security of the 
private key Sout will not be affected based on the security of the LWE distribution. 


By (6.3.14) in Lemma 6.3.2, the input ciphertext cj, is converted into a new output 
ciphertext Cou = K GT! (Cin). Cout is obtained by using the key Sout, this is because 


SoutCout = ike (Cin)) 
el -1 Z q 
=, 5,G-G (Cin) =y U H (mod q). 
We replace Cin = c1 ® c2 and Sin = s ® s with the new ciphertext coy, and the con- 
verted key Sout, which significantly reduces the dimension of the ciphertext. 


2. GSW fully homomorphic encryption 


In 2013, Gentry et al. (2013) further improved BV fully homomorphic encryption 
by using gadget matrix and gadget technology. The greatest advantage is that fully 
homomorphic multiplication does not require the key conversion introduced in the 
previous subsection. 

First, we select a random matrix A € Ta. with the number of columns m large 


enough. Define the following two matrices by A 


Aj =x;G — AR; € ZP", i = 1,2, (6.3.16) 
where x1, x2 € Zq are two integers, G is the gadget matrix, 
G = diag{g’, g’,..., 8'}nxni, 8’ € Zl, 
here / = [log,qg], Ri € ‘gaa is the Gauss matrix. 


Lemma 6.3.3 1. The trapdoor matrix of [A, A, + Aglis k - = the tag matrix 
n 
is xı la + x2}. 


2. The trapdoor matrix of [A, AGT! (A2)] is 


I ), the tag matrix is x1x2ln, 
n 


where 
R = xı R + Ri G7! (A3). (6.3.17) 


Proof By (6.3.16), it is easy to get 


Ai +A = (x1 + 42)G — A(Rı + Ro). (6.3.18) 
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We regard each column vector of Az as the target vector u in Lemma 2.2, then the 
inverse matrix G~! in Definition2.2 can be generalized to G~!(A2) € an xml here 
G~!(A2) = x is the shortest integer solution of (because each column of the matrix 
x is the shortest integer solution) 
Gx = A, (mod q). (6.3.19) 
Thus, (6.2.7) generalizes to 
G - (G71 (A2)) = Az (mod q), (6.3.20) 


so we have =) 
AGT! (A2) = (x1G — AR,)G7'(A2) 


= x) A2 — AR|G~!(Ap) 
= x1xX9G — x, AR) — AR, G~!(A>) 


= x1xX2G — A(x, R2 + R1G~!(A2)). (6.3.21) 
Let A =[A, A; + A2], R = ~“ a “i by (6.3.18), we get 


AR = A, + A + A(R; + Ro) = (x1 + x2) 4,G, 


therefore, R is the trapdoor matrix of A, and the tag matrix is H = x1 In + x21. We 
have proved (i) in this lemma. To prove (ii), let 


A = IA, A167! (423)], R= (7) ; 


where 
R = xı Ro + RiG (Ap). 


Based on (6.3.21), 
AR = AR + AiG! (A2) 


= Axı Rə + ARG! (A2) + AiG '(A2) 


= X1xX2G, 


this implies R = (; 
So (ii) in this lemma holds. 


) is the trapdoor matrix of A, and the tag matrix is H = x, x2J,. 
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In order to fully prove the conclusion of lemma 3.3 , it is also necessary to prove 
that the corresponding trapdoor matrix is a Gauss matrix, which is summarized in 
the following lemma. 


Lemma 6.3.4 If R is a Gauss matrix, then (7) is also a Gauss matrix. If Ry and 


In 
Rv are independent Gauss matrices, then R, + Rz is a Gauss matrix. 


Proof Since 0 and 1 can be regarded as discrete Gauss distributions with parameter s 


R\. : 

I is also a Gauss matrix. On the other hand, the sum of two 
n 

independent random variables with Gauss distribution still has Gauss distribution, 

so Rı + Ro is a Gauss matrix. The lemma holds. 


close enough to 0, then 


Now we discuss the workflow of the GSW fully homomorphic encryption. 

Key: the public key is A € Lm, m = n + nl, each column of A is an independent 
sample of the LWE distribution A, , under the private key 5 € Z| Lets = (T) € 
Zp if x has discrete Gauss distribution, we have (see 4.1.3 in Chap. 4) 


s'A =, 0 (mod q), (6.3.22) 


with the private key s = G) € Zy 
Encryption: let x € Z be a plaintext, f(x) be an n x nl dimensional matrix A 
encrypted for x, 
f(x) =A =xG — AR, (6.3.23) 


i.e. A is the ciphertext, G is the n x nl gadget matrix, R € gex is a Gauss matrix. 


Decryption: based on (6.3.22), decrypt A with the private key s = (7) , 


s'A=xs'G—s'AR 


=, xs'G (mod q). (6.3.24) 


Correctness: since s’A is a given ciphertext matrix, and G is the gadget matrix, 
by (6.2.8), 
xs’G =, s'A (mod q), 


we can solve the only one solution xs’ with high probability, and get f—'(A) = x. 


Theorem 6.3.2 The GSW encryption system is bounded fully homomorphic encryp- 
tion, where the addition and multiplication of the ciphertexts are defined as if 
A, = f (x1), A2 = f (%2), then A, + A3 is the matrix addition, and 
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Aj Az = AG! (A2) € gxn (6.3.25) 


is the matrix multiplication. 


Proof The conclusion of theorem 2 is actually implied in lemma 3.3. Let x1, x2 € Zq 
be two plaintexts, 
| Ai = f(x) = x1G — AR;, 
A2 = f (%2) = x2G — AR», 


then _ 
A, + Ag = (x1 + X2)G — ACR, + Ro), 


so we have (with high probability) 
f(A + A2) = x1 + x2 = f7 (A1) + f"(Ad). 


Let 
R = xi R + RiG7! (A3), (6.3.26) 


according to (6.3.21), 
Ai A2 = AiG! (A2) = x1xX2G — AR, 


therefore, 
fo'(A1A2) = x1x2 = f(A) f (A2). 


Since GSW encryption system is based on Gauss distribution, the Gauss matrix in 
(6.3.23) has errors. The error will be larger by adding and multiplying the cipher- 
text matrix many times. GSW encryption system is bounded fully homomorphic 
encryption, so it is necessary to control the error when adding and multiplying the 
ciphertexts in order to ensure high probability. This is because the larger the error 
of Gauss distribution, the smaller the probability, and the probability that the above 
equation holds also decreases. 


To complete the proof of Theorem 6.3.2, we need the following lemma. 


Lemma 6.3.5 If Rı and R, are Gauss matrices, then the matrix defined by (6.3.26) 
is also a Gauss matrix. 


Proof Since both R; and R are Gauss matrices, then xı R2 and RG! (A2) are 
Gauss matrices, based on lemma 3.4, 


R = xi Ro + RıG™' (A2) 


is a Gauss matrix. Lemma 3.5 holds. 
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Finally, we emphasize that the advantage of GSW fully homomorphic encryption 
is that the dimension of ciphertext multiplication does not increase. The ciphertext 
multiplication defined by (6.3.25), in fact, A; Az and A;, A3 are in the same ciphertext 
space. 


6.4 Construction of Gentry 


In 2009, C. Gentry first proposed a bounded algorithm for fully homomorphic encryp- 
tion, which partially answered the RAD problem. The work by Gentry is an abstract 
description of fully homomorphic encryption (Garg et al., 2013a, 2013b; Gentry, 
2009a, 2009b, 2010; Gentry et al., 2012a, 2012b, 2013a, 2015; Gentry & Halevi, 
2011). It is difficult to understand the ideas and technologies by Gentry since there 
are many linguistic concepts. On the basis of BV fully homomorphic encryption and 
GSW fully homomorphic encryption in the previous section, it is possible for us to 
better understand Gentry’s ideas and methods. 

Recall the working principle of the most representative public key cryptography 
RSA. Suppose N is the product of two different prime numbers, pk denotes the public 
key, and the public key of RSA is pk = (N, e), where 1 < e < g(N), (e, g(N)) = 1, 
g(N) is the Euler function of N. For any plaintext 7; € Zy (0 < m; < N), the 
encryption algorithm of RSA is y; = xf (mod N), we write 


{w; <— 7; mod N} (6.4.1) 


as the cryptosystem of the ciphertext y; encrypted by the plaintext 7; using the public 
key pk. If there are t ciphertexts {w1, W2,..., Y1}, obviously, 
t 


Wi 


1 


l 


t t £ 
[au < (im) mod N), 
i=l i=l 


this shows that the product TI y; of t ciphertexts y; is encrypted by the product IIi; 7t; 
of the corresponding t plaintexts z;. In other words, the plaintext corresponding to 
the product of the t ciphertexts is the product of the rf plaintexts 7;. In section 6.1, 
we use the decryption algorithm to describe this multiplicative homomorphism as 


(1 m) (mod N), 
i=l 


so we have 


A (4 vs) = fh). 


In order to define homomorphic encryption more generally, we first introduce the 
concept of circuit, which is widely used in the computer field. 
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Definition 6.4.1 A circuit C on the set A is a multivariate mapping defined on A. 
For any t elements a1, d2,..., a; € A, C (a1, a2, ..., a) is the image of the mapping 
C. From the perspective of computer work, we can take (a), dz, ..., ap) aS an input, 
and C(ai, a2,...,a;) is regarded as one output. Multiple input and output can be 
viewed as a circuit. If there are multiple circuits C on A, the set of these circuits is 
written as C4. 

In a public key cryptosystem E, we use pk and sk to represent the public key and 
the private key respectively. Of course, pk and sk are not just one element, there may 
be many public and private keys. 


Definition 6.4.2 A public key cryptosystem Æ with the circuit set Cg is called a 
fully homomorphic encryption system, if E contains the following four algorithms: 


1. Key generated algorithm, denoted as K Gg. 
2. Encryption algorithm, denoted as Eng. 

3. Decryption algorithm, denoted as Dg. 

4. Ciphertext algorithm, denoted as Eval,. 


For any public key pk, and any circuit C € Cg onthe plaintext space, any t ciphertexts 


Wi, Wo,..., Yr, where 
Yi — Ene (pk, mj), 1 <i <t, (6.4.2) 
the ciphertext algorithm Eval, is to compute 


w < Evale(pk, C, Y1, W, .-., Wr), 


where W is the encryption of C (71, 72, ..., 7,) under the public key pk, i.e. 
Y < Ene(pk, C(m, %2,...,7)). (6.4.3) 


Remark 6.4.1 The number of elements of a circuit is denoted as |C|, which is called 
the boundary of the circuit. Usually the computational complexities of K Gg, Eng, 
Dyg and Eval, are polynomial of the security parameter A and the circuit boundary 
IC]. 


Remark 6.4.2 An equivalent form of (6.4.3) is 

C(m1, 2,..., T1) = Dne (Y), (6.4.4) 
that is, the plaintext corresponding to the calculation result y under the ciphertext 
algorithm Eval, by the t ciphertexts W1, W2, ..., Y; is the output in the circuit 


C (T1, %2,..., 1) by T1, T2, ..., 1. Therefore, in a fully homomorphic encryption 
system, the plaintext circuit C actually defines the ciphertext circuit D, where 


Din, Wa, ae} Wi) = Evalg(pk,C, pi, p, srg pi) 
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satisfying 
Dne (Di, Wa, -- +s Wr) = Ct, Wa, ..., T). (6.4.5) 


The basic idea of Gentry is to construct fully homomorphic encryption ona general 
ring. In order to prove the security, the ideal of a quotient ring on the rounding function 
ring Z[x] is corresponding to an ideal lattice in Z” (see Chap. 5), so the construction 
of Gentry is called fully homomorphic encryption based on ideal lattice now. 

Let R be a commutative ring with identity, J and J are two coprime nonzero ideals 
in R, i.e. I + J = R, R/I and R/J denote the quotient rings. The construction of 
Gentry can be divided into the following steps: 


Q Fix an ideal J of R and a basis B; of J. 

@® For any ideal J of R, (J, J) = 1, we give an ideal generating algorithm 
IdealGen(R, Br) to generate the public key basis B = and the private key basis 
B&K. In fact, BY could be chosen as another ideal J; of R, such that J = J, 
B5k = B; is the basis of Jj. 

© Construct a sampling algorithm Samp(x, Bz, R, By), 


Samp(x, B;, R, Bj) = a representative element of additive coset x + I =X. 


®© In the ciphertext algorithm any circuit of R is computed in R/J, i.e. if x1, x2 € 
R/T, then C(x1, x2) = x3 (mod /). Take the addition circuit and the multipli- 
cation circuit as an example, for any x1, x2 E€ R/I, x; + x2 = x3 (mod J), there 
exists only one x3 under the sampling algorithm Samp(x, Bz, R, Bz), which is 
denoted as Addg,. Similarly, the multiplication in R/J is denoted as Multz,. 
© Ciphertext generation. Fix a ring R and an ideal Z of R, then 


KG(R, Br) = (B%, BP") < IdealGen(R, By), 


the plaintext space is a representative element set of the quotient ring R/T. 


The public key contains R, B;, B A k and the sampling algorithm. 

The private key sk contains ean 

The encryption algorithm: the plaintext space is R/J, for any plaintext u € R/T, 
based on the sampling algorithm we have Samp(u, B7, R, BP) — w’, the encryp- 
tion algorithm En(pk, u) is defined as 


En(pk, u) = Y = y’ mod BM, 
The decryption algorithm De(sk, yw) is defined as 


u <— (y mod BS‘) mod By. 
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The ciphertext algorithm: if Yı, Y2 are two ciphertexts, then the addition and 
multiplication are defined as 


Add (pk, 1, W2) = Wi + Y2 = (Yı + Yo) mod BP, 


Mult (pk, y1, Wa) = yi y2 = ir) mod BP. 


The key of Gentry’s construction is to verify the correctness of encryption and 
decryption and the homomorphism property of the ciphertext algorithm. We call the 
above public key generation algorithm, encryption algorithm, decryption algorithm 
and ciphertext algorithm as the fully homomorphic encryption system of Gentry, 
denoted as E. In order to prove the fully homomorphic property of E, we observe 
that there are two kinds of circuits in E. First, the circuit C used for encryption is 
defined by the addition and multiplication in the quotient ring R/J. The other circuit 
used in the ciphertext algorithm is defined by the addition and multiplication in R 
itself, which is called the generating circuit. 


Definition 6.4.3 Given a circuit C in the plaintext space, we call g(C) its generating 
circuit if the operation of mod Bz in C is replaced by the original addition and 
multiplication. 


Definition 6.4.4 Let Xenc be the image of R/I under the sampling algorithm Samp, 
i.e. Xenc 1s a set of representative elements of R/J, and Xenc is a plaintext space, so 
the ciphertext space is {Xene + J}. Define X pec as R mod Be , 1.e. the representation 
of the elements in R/J under mod Be 


Definition 6.4.5 The circuit satisfying the following condition in the circuit set Cg 
is called an allowable circuit set, 


Cr = {C : V(x, X2,..., X) € Xle => g(C)(x1, X2, ..., X4) E XDec}. (6.4.6) 


On the basis of the above definitions and notations, the main conclusion of Gen- 
try is that for any ciphertext [see (6.4.3)] in any allowable circuit, it has the fully 
homomorphic property. 


Theorem 6.4.1 Let Cg be an allowable circuit set, then the ciphertext encrypted by 
any allowable circuit C in Cg has the fully homomorphic property. 


Proof LetC € Cg, Y = {W, W, ..., Yr}, where each y; is the encrypted ciphertext 
of the allowable circuit, so each ciphertext yy could be written as 


We = Tk + ik + jk, mg € R/T, ik € I, Ike € J, 
and my, + ix E€ Xenc. We have 


Eval(pk, C, Y) = g(C)(W) mod BY 
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e g(C) Gri +i, m2 Pia ees T +i) +J. 


If C € Cp, then 
ECC) (Xencs Xenc, ELE. Xenc) € X Dec, 


therefore, 
Decrypt(sk, Eval (pk, C, Y)) 


= g(C)(m + i1, 2 + i2, ..., T, + i1) mod B; 
= g (C) (m1 + m2 +--+- + 7) mod B; 
= C (T1, T2, kespi) 


Applying the above conclusion to the addition circuit and the multiplication circuit 
respectively, we get the fully homomorphic property in the allowable circuit. 


We choose R = Z[x]/<f(x)>, where f(x) € Z[x] is a monic polynomial of 
degree n. Each polynomial in the quotient ring R corresponds to a vector in Z”: 


ao 
ai 
a(x) = ao + aix +- -+a 1x"! € R 4> a = . eZ". 


Qn-1 


Furthermore, the correspondence between the ideal in R and the ideal lattice in Z” is 
one-to-one (see Chap. 5). For example, J = <a(x)> is the principal ideal generated 
by a(x) € R, then 

<a(x)> = I 4— L(HA*(a)), 


where H*(œ) is the ideal matrix generated by a, L(H*(q)) is the integral lattice 
generated by H* (æ). For I C R, I is not a principal ideal, based on Chap. 5 we 
know 

L(I) = {æ | a(x) e I) c Z" 


is an integral lattice. Denote B; as the generating matrix of L(I), then Bz is the basis 
of ideal J in the construction of Gentry. In the key generation algorithm constructed 
by Gentry, the public key is B? * We select an ideal J C R such that (I, J) = 1 with 
the basis B;, i.e. J is the generating matrix of the corresponding ideal lattice L(J). 
For convenience, 

B?* = the HNF basis of L(J) 
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is the Hermite normal basis of L(J). The private key is B**, we choose an ideal Jı 
larger than J, i.e. J C Ji C R, J Æ J, so 


BI = the generating matrix of the ideal lattice L (J1). 
Since J C J), by the homomorphism theorem of ring we have 
Ji/J = (R/S) /(R/J))- 


Here R/J, is a subring of R/J, so in the sampling algorithm, for any a € R/J, we 
can find only one aj, E€ R/ J. 

Above all, we can take R as a specific quotient ring Z[x] / < f (x)> of the integer 
coefficient polynomial ring Z[x] to realize the construction of fully homomorphic 
encryption by Gentry. Since the correspondence between the ideal in R and the 
ideal lattice in Z” is one-to-one, Gentry’s construction is widely known as a fully 
homomorphic encryption system based on the ideal lattice. Because the conclusion 
is only valid on the set of allowable circuit, it is only a bounded fully homomorphic 
encryption. 


6.5 Attribute-Based Encryption 


Fully homomorphic digital signature is a research hotspot at present, among which 
attribute-based encryption is a relatively mature topic. Attribute-based encryption 
(ABE) is a generalized form of identity-based encryption which is proposed in Goyal 
et al. (2006) and Sahai and Waters (2005) first. In this section we will briefly introduce 
ABE. 


Lemma 6.5.1 Let g be a prime number, F; be a finite field with q elements, Fax be 
an extension of degree n of F4, then Fn is isomorphic to a subring H of Z”, where 
a,b € H > a-b e GL, (fy), ie. a — b is an invertible matrix. 


Proof Fj / F; is an n dimensional linear space, let {¢1, œ2, ..., 0} C Fyx be a 
basis. For any a € Fj, we define a linear transformation ty on Fn 


Talx) = ax, x © Fon. (6.5.1) 


Obviously Tą is a linear transformation on Fy». Under the given basis {a;, 02, ..., Mn}, 
let Ay be the corresponding matrix of Tg, that is, 


Ta (01, Q2, wey Qn) = (aa), 2, ce, Qn) = (a1, 2, 625 An )Aw. 


Let 
H= {Aw | QE Far} G Le 
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we have 
Aa+p = Ag+ Ag, Ag.p = Ag: Ag, 


so Fyn — H is a ring isomorphism. Note that if a Æ 0, then tT, is an invertible linear 
transformation on Fg», and the corresponding matrix Ag of Tg is an invertible matrix. 
Ifa,b € Fyn, a Æ b, it follows that Aa—» € GL, (F;), in other words, the difference 
of any two different matrices in the matrix ring H is an invertible matrix. 


Remark 6.5.1 The trace function and determinant of the matrix A, corresponding 
to the linear transformation Tą are called the trace and norm of q, i.e. 


tr(@) = tr(Ag), N(a@) = det(Ag), 


where tr(œ) is an additive homomorphism of Fj» —> F}, and N (a) is a multiplicative 
Homomorphism of Fp > F}. 

Let Fy» be an n dimensional linear space of F}. Given a basis, Fgx and F} are 
isomorphic as the linear spaces of F}. For any elements a1, a2, ..., 7 € Fgn in Fon, 
we can define the inner product based on Lemma 6.5.1. 


Definition 6.5.1 For any a, $ € Fy, let x > Ha € H, p > Hg € H, we define 
the inner product of œ and f by 


<a, B> = Ha - Hg. (6.5.2) 


Remark 6.5.2 Since Ha - Hg € F,'*" is a square matrix of order n, the inner product 
of two field elements is a vector. If Hy - Hg € H, based on lemma 5.1, there exists 
y € Fy =r —> Ha Hg. However, we cannot get y = a - p, which means that 
(6.5.2) and the one-to-one correspondence of lemma 5.1 are not commutative. 


ABE encryption technique is a very complex matrix encryption method. The 
basic principle is to use the gadget matrix to generate encryption and decryption 
algorithms based on the LWE distribution. It involves the encryption public key 
of LWE cryptosystem, and a private key system based on the attribute vector and 
the dependent vector, which are the keys in the digital signature. In order to fully 
understand the workflow of ABE, we start with some basic matrices. 

Let q be a prime number, Z4 is equivalent to a finite field with q elements, and 
Z3 is equivalent to an extension of degree n of Z4. Let G be a gadget matrix of order 
n [see (6.2.6)], i.e. 


G = h 8 g' =diag{g’,g’,..., 8'} € ZP", 
where / = |log,q], define A and A by 
Ae Zy” is a uniformly random matrix, 


A = [A;, A2,..., Ai] € gxu (6.5.3) 


m=n+nl, w=nl, 
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where each A; € gpn has the same dimension with the gadget matrix G. Let A be 
the private key, R € gen be the trapdoor matrix of A with tag H, i.e. 


AR = HG (mod q). 
Based on Lemma 6.5.1, we define the attribute vector Eg by 
7 =([M, Mh, ..., Mle H, (6.5.4) 
where each H; € Zye is an invertible matrix, so € gyen , let 


Ve = [H,G, H)G,..., HG] € ZP", (6.5.5) 


Ay = A+ Gy EZ, 


the dependent vector Pp € H! defined by the attribute vector Ht satisfies 


where p = [P Po,..., Pile garn, and each P; € Zy” 
In order to discuss the generated private key by the dependent vector 2 let Sp 
be 


G! (PG) 
G-I (P,G) 

Ha , (6.5.6) 
G- (P,G) 


here G7! (P;G) is an integer matrix given by Definition 2.2. 


Lemma 6.5.2 Under the above notations, we have 
Gz -S3 = <n, p>G=0. 
Proof Combining (6.5.5), (6.5.6) and (6.2.7), it follows that 


G! (PG) 
Gz «o> = [A,\G, HoG,..., HG] : 
G! (P,G) 


= HGG! (P,G) +- -- + HGG! (P,G) 


= Hı PG + MPG +--+ + Hı P,G 
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= (Hı P| + HP +--+ + A P)G 


=<, p>G=0. 


Encryption: based on the above definitions, let u € Z”, we encrypt a single bit 
u € Zz by the LWE cryptosystem, and the ciphertext {¢, c+, c} satisfies 


x s! Az (mod q), (6.5.7) 


where s is the private key of the LWE cryptosystem. 
We write {c, cẹ , c} as the following form 


n? 


[ety c] =x s'[A, A+, u] + (a a) (mod q). 
2 


Decryption: generate the private key vector x satisfying the following equalities 
by the dependent vector Ps 


(6.5.8) 


use x= as the private key to decrypt the ciphertext {c, c=, c} as follows 


n?’ 
[c’, ch -S3]-x5, 


by (6.5.7), we replace the congruence with equality, then (based on Lemma 5.2) 


co -S3 = s'Az -S3 =s (A+ Gz)S3 


> 
P 


e 1 Ses ih 
=s B3 +s Gz : Sz =s Bz, 


p 


therefore, 


[e’, ch - Sg]: xg =x STA, B3]: xg (mod q) 


=, s'u (mod q) 
=cçc—u 5 (mod q) 
=u. 


Both x3 and Sz are the shortest integer solutions. 


174 6 Fully Homomorphic Encryption 


We will not verify the fully homomorphic property of ABE here, and leave it to 
the readers as an exercise. Constructing fully homomorphic digital signature by the 
ABE encryption technology is a popular research topic at present, and we suggest 
readers to follow up it further. 
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Chapter 7 A) 
A Generalization of NTRUencrypt get 


NTRU cryptosystem is a new public key cryptosystem based on lattice hard problem 
proposed in 1996 by three digit theorists Hoffstein, Piper and Silverman of Brown 
University in the United States. The essence of NTRU cryptographic design is the 
generalization of RSA on polynomials, so it is called the cryptosystem based on 
polynomial rings. Its main feature is that the key generation is very simple, and the 
encryption and decryption algorithm is much faster than the commonly used RSA 
and elliptic curve cryptography. In particular, NTRU can resist quantum computing 
attacks and is considered to be a potential public key cryptography that can replace 
RSA in the post-quantum cryptography era. 

Many researchers have presented some variations of NTRU by changing its alge- 
braic structure. In 2002, Gaborit introduced an NTRU-like cryptosystem called 
CTRU by replacing the base ring of the NTRU with a polynomial ring over a binary 
field Fy[x] (Gaborit et al., 2002). They proved that their system is successfully 
decrypted. In 2005, Kouzmenko showed that CTRU is weak under a time attack 
and proposed the GNTRU cryptosystem based on Gaussian integers (Kouzmenko 
2006). In the same year, Coglianese introduced an analog to the NTRU cryptosystem 
called MaTRU (Coglianese & Goi, 2005). MaTRU is based on a ring of all square 
matrices with polynomial entries. In 2009, Malekian introduced the QTRU cryp- 
tosystem based on quaternion algebra (Malecian et al., 2011). They also introduced 
the OTRU cryptosystem in 2010 based on Octonion algebra (Malecian & Zakerolh- 
sooeini, 2010). In 2016, Alsaidi proposed a public key cryptosystem BITRU based 
on binary algebra (Alsaidi & Yassein, 2016). However, all of the above variations 
of NTRU have limitations. The purpose of this chapter is extending the theory of 
circulant matrix to general ideal matrix, and constructing more general NTRU cryp- 
tosystem combining with the -cyclic code. The motivation of this research is to 
adapt the distributed scenario of blockchain architecture and apply the post-quantum 
cryptography in it. 
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7.1 -Cyclic Code 


Let F} be a finite field with q elements and q be a power of a prime number, F,[x] be 
the polynomial ring of F4 with variable x. Let F} be the n dimensional linear space 
over F}, and ġ = (ġo, 1, ---, On-1) € a be a fixed vector in F with ¢o Æ 0, the 
associated polynomial of ¢ given by 


P(x) =x" — nx"! —--- — bx — bo € Falx], o # 0. (7.1.1) 


Let <(x)> be the principal ideal generated by ¢ (x) in F, [x]. There is a one-to-one 
correspondence between Fy and the quotient ring R = F,[x] / <b(x)>, given by 


c = (Co, C1, ..-, Cn-1) € Fà Z c(x) = co + cix +--+ cix”! e R. (7.1.2) 


In fact, this correspondence is also an isomorphism of Abel groups. One may extend 
this correspondence to subsets of Fẹ and R by 


Cc F} 2 Cœ) = {e(x)le EC} CR. (7.1.3) 


If Cc Ey is a linear subspace of F a of dimension k, then C is called a lin- 
ear code in coding theory and written by C = [n, k] as usual. Each vector c = 
(Co, C1, +--+, Cn—1) € C is called a codeword of length n. Obviously, C = [n, 0] and 
C = [n, n] are two trivial codes. Another one is called constant codes, of which is 
almost trivial given by 


C={(b,b,...,b)|b € Fy}, and C = [n, 1]. 


According to the given polynomial ¢(x) in (7.1.1), we may define a linear transfor- 
mation Tg in F, oe 


Tp(c) = Th((CO,C1,---; Cn—1)) = (P0Cn—1, CO + $1Cn—1, C1 + $2Cn-1, +++, Cn—2 + bn iz 1). 


It is easily seen that tọ : F} —> Fù is a linear transformation. 


Definition 7.1.1 Let C C F a be a linear code. It is called a -cyclic code, if 
Yc € C > tlc) E C. (7.1.5) 


In other words, a linear code C is a ġ-cyclic code, if and only if C is closed under 
linear transformation tg. Clearly, if = (1, 0, ... , 0), and g(x) = x” — 1, then the 
ġ-cyclic code is precisely the ordinary cyclic code (Lopez-Permouth et al., 2009). 


Remark 7.1.1 The @-cyclic code we give here is polycyclic code in fact, which firstly 
appeared in Lopez-Permouth et al. (2009), but we mainly concern for its application 
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to McEliece and Niederriter’s cryptosystems. We first show that there is a one-to-one 
correspondence between ¢-cyclic codes in F 7 and ideals in R = F,[x] / <¢(x)>. 
Lemma 7.1.1 LetC C F} be a subset, then C is a -cyclic code, if and only if C(x) 
is an ideal of R. 


Proof We use column notation for vector in F}, then linear transformation tọ may 
be written as 


co PoCn-1 co 
c1 Co + P1Cn—-1 c1 a 
To = : 5 Yc = € E; 
Cn-1 Cn—2 + Pn—1€n-1 Cn-1 


Let Ty be an x n square matrix over Fy, 


(7.1.6) 


where J,,_; is the (n — 1) x (n — 1) unit matrix. The matrix expression of Tg as 
follows 


co co oCn-1 
C1 ci co + b1Cn-1 
zs =T; = 11.7) 
Cn—1 Cn-1 Cn—2 + Pn—1Cn—1 


Suppose C C F% and C(x) is an ideal of R, it is clear that C is a linear code of F?. 
To prove C is a @-cyclic code, we note that for any polynomial c(x) € C(x), then 
xce(x) € C(x) if and only if tg(c) € C, namely, if c(x) € C(x), then 

xe(x) € C(x) & nyo ECC & Tyc € C. (7.1.8) 
Therefore, if C(x) is an ideal of R, then we have immediately that C is a -cyclic 


code of F oe 
Conversely, if C C F # is a ġ-cyclic code, then for all k > 1, we have 


Veet S Tice, 
It follows that 


Ye(x) € C(x) > x*ce(x) € C(x), OS k<n—1, 


which implies C(x) is an ideal of R. This is the proof of Lemma 7.1.1. 
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By Lemma 7.1.1, to find a -cyclic code, it is enough to find an ideal of R. There 
are two trivial ideals C(x) = 0 and C(x) = R, the corresponding @-cyclic codes 
are C = [n, 0] and C = F} , respectively, which are called trivial @-cyclic code. To 
find non-trivial -cyclic codes, we make use of homomorphic theorems, which is a 
standard technique in Algebra. Let x be the natural homomorphism from F,[x] to 
its quotient ring R = F,[x] / <(x)>, kern = <¢(x)>, 


<o(x)> CNC F,[x] —+R= Fy[x]/<o(x)>, (7.1.9) 
where N is an ideal of F,[x], of which is containing kerm = <@(x)>. Since F,[x] 


is a principal ideal domain, then N = <g(x)> is a principal ideal generated by a 
monic polynomial g(x) € F,[x]. It is easy to see that 


<O(x)> C <g(x)> + 8(x)|G@). 
It follows that all ideals N satisfying (7.1.9) are given by 
{<g(x)> | g(x) € F,[x] is monic and g(x)|P(x)}. 
We write by <g(x)> mod ¢(x), the image of <g(x)> under 7, it is easy to check 


<g(x)> mod $(x) = {h(x)g(x) | h(x) € Fy[x] and degh(x) + degg(x) < n}, 
(7.1.10) 
more precisely, which is a representative elements set of <g(x)> mod ¢(x), by 
homomorphism theorem in ring theory, all ideals of R given by 


{<g(x)> mod ¢(x) | g(x) € F,[x] is monic and g(x)|@(x)}. (7.1.11) 


Let d be the number of monic divisors of (x) in F,[x], we can get the following 
corollary immediately. 


Lemma 7.1.2 The number of $-cyclic code in Fi isd. 
To compare the -cyclic code and ordinary cyclic code, we see a simple example. 


Example 7.1 Constant code C is always a cyclic code for 1 + x +- -+ +x"! |x”" — 
1, and its generated polynomial is just 1 + x +----+-x"~!. But constant code C in 
F} is not always a -cyclic code, it is a p-cyclic code if and only if 1 +x +--+ + 
x"—"/@(x), an equivalent condition for 1 + x + ---+x""'|@(x) is 


Ọn-1 = On-2 = +: =H =b, and ġo = 1 + b. 


Definition 7.1.2 Let C be a -cyclic code and C(x) = g(x) mod ¢ (x). We call g(x) 
is the generated polynomial of C, where g(x) is monic and g(x)|ġ (x). 
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Lemma 7.1.3 Let g(x) = go + g1x +- + 8n—K-1x"-*! + x" be the generated 
polynomial of a -cyclic code C, where 1 S k <n — 1, and g(x)|ġ (x), then C = 
[n, k] and a generated matrix for C is the following block matrix 


& 
T4(8) 
G=| (8) , (1.1.12) 
T (8) kxn 
where g = (80, 81, ---, &n-k—1; 1, 0,...,0) € C is the corresponding codeword of 


g(x), and Ti (8) = T4 '(to(g)) fori <i<n—1. 


Proof By assumption, C(x) = <g(x)> mod ¢ (x), then {g, tg(g),..-, T5 (8)} Cc 
C, we are to prove it is a basis of C. First, these vectors are linearly independent. 


Otherwise, we have 
k-1 


X bit) (g) = 0, bi € Fy, (7.1.13) 


i=0 


and the corresponding polynomial is zero, namely 


k-1 
(x os! g(x) =0. 


i=0 
It follows that x 
—1 
X dix =0 => b; =0foral0<i<k-l1. 
i=0 


Next, if c € C, and c(x) € C(x), by (7.1.10), there is a polynomial b(x) = bọ + 
bix + +++ + bg-2x%7? + x*-! such that 


k—1 


c(x) = bO)g(x) = (x ox! g(x), bai =l, 


i=0 


Thus we have the corresponding codeword of C(x) 


k-1 
c=) bai). 
i=0 


This shows that {g, tg(g),..-, T (8)} is a basis of C, and a generated matrix for 
C is 
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&§ 
T (8) 
G= T§(g) 


t3 (8) 


kxn 


We have Lemma 7.1.3 at once. 


To describe a parity check matrix for a -cyclic code, for any c = (co, C1, . 
Cn—1) E€ F”, we write 


-3 


= n 
c= (Cn—1, Cn—25+++5Cl, co) = Fie 


Lemma 7.1.4 Suppose C is a ġ-cyclic code with generated polynomial g(x), where 
g(x)|ġ (x) and degg(x) =n — k. Let h(x) g(x) = ġ (x), where h(x) = ho + hıx + 
<<- + hgx! + x“. Then a parity check matrix for C is 


he 
tp (h) 


(7.1.14) 
h) 


(n—k)xn 


Proof Since h(x)g(x) = ġ (x), itmeans thath(x)g(x) = Oin R = F,[x] /<@(x)>; 
thus we have 


gohi + gilizi + +++ + 8n—khi-nsk = 0, VO<i <n—I, 


It follows that GH’ = 0, where G is a generated matrix for C given by (7.1.12). 
Therefore, H is a parity check matrix for C. 


A separable polynomial in Algebra means that it has no multiple roots in its 
splitting field. The following lemma shows that there is an unit element in any non- 
zero ideal of R, when ¢ (x) is a separable polynomial. 


Lemma 7.1.5 Suppose (x) is a separable polynomial of F}, and C(x) = g(x) mod 
(x) is an ideal of R with degg(x) < n — 1, then there exists an element d(x) € C(x) 
such that 

c(x)d(x) = c(x), Ve(x) € C(x). 


Proof Let h(x)g(x) = (x). Since (x) is a separable polynomial, then 
gcd(g(x), h(x)) = 1, and there are two polynomial a(x) and b(x) in F,[x] such 
that 

a(x)g(x) + b(x)h(x) = 1. 
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Let 
d(x) = a(x)g(x) = 1 — b(x)h (x) € C(x). 


If c(x) € C(x), by (7.1.10), we write c(x) = g(x)gı (x), it follows that 
c(x)d(x) = a(x)g(x)g(x)gi(x) = (A — bx )h(x))g (x) 81 (x) 


= g(x)gi(x) = c(x)(mod $(x)). 


Thus we have c(x)d(x) = c(x) in R. 


Next, we discuss maximal -cyclic code. Let C(x) = g(x) mod @(x), and g(x) 
be an irreducible polynomial in F,[x], we call the corresponding @-cyclic code C a 
maximal -cyclic code, because <g(x)> is a maximal ideal in F} [x]. 


Lemma 7.1.6 Let C be a maximal $-cyclic code with generated polynomial g(x), 
B be a root of g(x) in some extensions of F}, then 


C(x) = {a(x) | a(x) € R and a(B) = 0}. (7.1.15) 
Proof If a(x) € C(x), by (7.1.10) we have a(8) = 0 immediately. Conversely, if 


a(x) € F,[x] and a(B) = 0, since g(x) is irreducible, thus we have g(x)|a(x), and 
(7.1.15) follows at once. 


An important application of maximal @-cyclic code is to construct an error- 
correcting code, so that we may obtain a modified McEliece-Niederriter’s cryptosys- 
tem. To do this, let 1 < m < „y/n, and Fn be an extension field of F} of degree m. 
Suppose Fyn = F} (0), where @ is a primitive element of Fy» and F; (0) is the simple 
extension containing F} and 0. Let g(x) € F,[x] be the minimum polynomial of 6, 
then g(x) is an irreducible polynomial of degree m of F,[x]. Itis well known that Fim 
is a Galois extension of F}, so that all roots of g(x) are in Fym. Let By, B2,..-, Bm 
be all roots of g(x), the Vandermonde matrix V (61, 2, ..., Bm) defined by 


1 By Bp? S 
1 Bo Bye me 


H = V (bi, Bo,..-, Bn) = ; (7.1.16) 


1 Bm b; apa na mxn 
where fı = 0 and each £; is a vector of (F})”. For arbitrary monic polynomial 
h(x) € F,[x], degh(x) = n — m, let (x) = h(x)g (x) and C be a maximal -cyclic 


code generated by g(x). It is easy to verify that 


ceC $s cH'=0. 
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Therefore, H is a parity check matrix for C. If we choose the primitive element 6, so 
that any d — 1 columns in H are linearly independent, then the minimum distance 
of C is greater than d, and C is a t-error-correcting code, where t = [4]. 

The public key cryptosystems based on algebraic coding theory were created by 
Lyubashevsky and Micciancio (2006), and Micciancio and Regev (2009) a suitable 
t-error-correcting code plays a key role in their construction. The error-correcting 


code C should satisfy the following requirements: 


1. C should have a relatively large error-correcting capability so that a reasonable 
number of message vectors can be used; 

2. C should allow an efficient decoding algorithm so that the decryption can be 
carried out with a short time. 


Our results supply a different way to choose an error-correcting code by selecting 
arbitrary irreducible polynomials g(x) € F,[x] of degree m and roots of g(x) rather 
than an irreducible factor of x” — 1 and the roots of unit. 

In fact, for any positive integer m, there is at least an irreducible polynomial 
g(x) € F[x] with degree m. Let N,(m) be the number of irreducible polynomials 
of degree m in F,[x], then we have (see Theorem 3.25 of Lidl & Niederreiter, 1983) 


1 1 ñ 
Nam) = — X ugt = — Y uag, 


d\m d\m 


where u(d) is Mobiiis function. 

Assuming one has selected two monic and irreducible polynomials g(x) and 
h(x) with degg(x) = m and degh(x) = n — m, let d(x) = g(x)h(x), then one may 
obtain @-cyclic code C generated by g(x) or h(x), which is more convenient and 
more flexible than the ordinary methods. 

It’s difficult to compare the error-correcting capability between -cyclic code with 
existing cyclic codes of the same length and dimension. However, we believe that 
the advantages of -cyclic code will become more clear when q increases. 
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The public key cryptosystem NTRU proposed in 1996 by Hoffstein, Pipher and Sil- 
verman is the fastest known lattice-based encryption scheme; although its descrip- 
tion relies on arithmetic over polynomial quotient ring Z[x]/ <x” — 1>, it was 
easily observed that it could be expressed as a lattice-based cryptosystem (see IEEE, 
2000). For the background materials, we refer to Hoffstein et al. (1998), Lint (1999), 
McEliece (1978). Our strategy in this section is to replace Z[x] / <x” — 1> by more 
general polynomial ring Z[x] /<@(x)> and obtain a generalization of NTRUEn- 
crypt, where ġ (x) is a monic polynomial of degree n with integer coefficients. 
In this section, we denote ¢(x) and R by 
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(x) =x" — paix"! — +» — bix — bo € Z[x], R= ZLx]/ <)>, bo £0. 
(7.2.1) 


Let Hy € Z"*" be a square matrix given by 


(7.2.2) 


where J,_; is (n — 1) x (n — 1) unit matrix. As described in Chap. 5, (x) is the 
characteristic polynomial of H, and H defines a linear transformation of R” —> R” 
by x — Hx, where x is a column vector of R”. We may extend this transformation 
to R” and denote o by 


o 3) = (iis) , where (3) cR”. (1.2.3) 


Of course, o is again a linear transformation of R” > R”. 
A q-ary lattice is a lattice L such thatq Z” C L C Z”, where q is a positive integer. 
We give the following definition of convolutional modular lattice. 


Definition 7.2.1 A q-ary lattice L is called convolutional modular lattice, if L is in 
even dimension 2n satisfying 


y (3) eL>o (i) = a EL, (7.2.4) 


here aw and £ are column vectors in R”. In other words, a convolutional modular lattice 
is a q-ary lattice in even dimension and is closed under the linear transformation o. 

Recalling the secret key p ) of NTRU is a pair of polynomials of degree n — 1, 
we may regard f and g as column vectors in Z”. To obtain a convolutional modular 
f 
8 


lattice containing , we need some help of ideal matrices. In Chap. 5, we introduce 


the definition of ideal matrix generated by a vector f, 
POSH Gy If, Hf, B? f,- , H" flaxa, (7.2.5) 


which is a block matrix in terms of each column H* fO<k<n-1). Itis easily 
seen that H*(f) is a generalization of the classical circulant matrices. In fact, if 


pa) =x" 1, f@) = fot fix + + fix” € Ze, 


the ideal matrix Hj(f) generated by f is given by 
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fo Sn-1 fi 
fi fo sh 

H*(f) = : : : , P(x) =x" l, 
Ja-1 Ja- fo 


which is known as a circulant matrix. On the other hand, ideal matrix and ideal lattice 
play an important role in Ajtai’s construction of a collision-resistant Hash function, 
the related materials we refer to Ajtai and Dwork (1997), Ajtai (1996), Lint (1999). 

We have given some properties of ideal matrix from Lemmas 5.2.1-5.2.4 in 
Chap. 5. Based on these lemmas, next we construct a convolutional modular lat- 


tice containing vector (1). Let (1) € Z”, (H*(f))" be the transpose of H*(f), 


and 
fT g7 
JH? eg HT 
A=[(H*(f))", (Ee | EY gY 028 
JFE (HTy! ei (Ay! cee 
* n—1 
ae. ao) = c Hpi A l (12.7) 
H (8) § Hg “aH 'g 2nxn 


We consider A and A’ as matrices over Zq, ie. AE a Ale a a q-ary 
lattice A, (A) is defined by 


A,(A) ={y € Z?” | there exists x € Z” > y = A’ x (mod q)}. (7.2.8) 
Under the above notations, we prove that A, (A) is the convolutional modular lattice 


containing (1) ; 
8 


Theorem 7.2.1 For any column vectors f € Z" and g € Z", A,(A) is a convolu- 


tional modular lattice, and 
J 
€ A, (A). 
( q(A) 


Proof It is known that A, (A) is a q-ary lattice, i.e. 
qz” C Ag (A) Cc Z”, 
We only prove that A, (A) is fixed under the linear transformation o given by (7.2.4). 


If y € A,(A), then y = A’ x (mod q) for some x € Z”, by Lemma 5.2.1 in Chap. 5, 
we have 
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_ (HH (f)x\ _ (H*(f)Hx)\ _ 
o(y) = G24 = ees = A’ Hx (mod q). 


It means that o (y) € A,(A) whenever y € A,(A). Let 
1 


e= | . | € Z = H*(f)e = f, and A*(g)e= g. 


We have 


t) € A, (A). 


Since A, (A) C Z?” then there is a unique Hermite Normal Form of basis N, 
which is a upper triangular matrix given by 


Theorem 7.2.1 follows. 


* 
N = a) , where h = (H*(fF) g (mod q). (7.2.9) 
Next, we consider parameters system of NTRU. To choose the parameters of NTRU, 
let dy be a positive integer and {p, 0, —p}" C Z” be a subset of Z”, of which has 
exactly dr + 1 positive entries and dy negative ones, the remaining n — 2dy — 1 
entries will be zero. We take some assumption conditions for choice of parameters 
as follows: 


1. d(x) = x” — by_1x" |! — --- — pix — po € Z[x] with ġo Æ 0, and ¢(x) is sep- 
arable polynomial, n, p, q, df are positive integers with n prime, 1 < p < q and 
gcd (p,q) = 1. 

2. f(x) and g(x) are two polynomials in Z[x] of degree n — 1, the constant term 
of f(x) is 1, f — 1 and g are the corresponding vector of f(x) — 1 and g(x), 
such that 


f—l1e{p,0,-p}", ge{p,0,-př. 


3. H*(f) is invertible modulo q. 
4. dp < ($-1)/4p— 5. 


Under the above conditions, by Lemma 5.2.2 in Chap. 5 we have 
H*(f) = I, (mod p), and H*(g) = 0 (mod p). (7.2.10) 


Now, we state a generalization of NTRU as follows. 
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1. Private key. The private key in generalized NTRU is a short vector U ) a2. 


and A, (A) is the convolutional modular lattice containing private key. 

2. Public key. The public key of the generalized NTRU is the HNF basis N of 
A, (A), which is given by (7.2.9). 

3. Encryption. An input message is encoded as a vector m € {1, 0, —1}” with 
exactly dy + 1 positive entries and d+ negative ones. Here the reason for restrict- 
ing dy + | positive and d+ negative entries of vector m is to improve the efficiency 
of encryption and decryption and it’s not necessary. The vector m is concatenated 
with a randomly chosen vector r € {1, 0, —1}” also with exactly dy + 1 positive 


entries and d+ negative ones, to obtain a short error vector (" ) e {1,0, — 1}, 


Let : 
a =N ("") = (” n =) (mod q), (1.2.11) 


where h is given by (7.2.9). Then, the n dimensional vector c 
c = m + H*(h)r (mod q) 


is the ciphertext. 
4. Decryption. Suppose the entries of n dimensional vector c are belong to interval 
4 4 


[-5, 5], then ciphertext c is decrypted by multiplying it by the secret matrix 


H*(f) mod q, it follows that 


H*(f)c = H*(f)m+ H*(f)H*(h)r = H*(f)m + H*(g)r (mod q). 
(7.2.12) 
Here, we use (ii) of lemma 5.2.4 in Chap. 5, namely, 


H*(f)H* (8) = H*(A*(f)g), 


If the above four conditions are satisfied, it is easily seen that the coordinates of 
vector H*(f)m + H*(g)r are all bounded by 4 in absolute value, or, with high 
probability, even for larger value of d f. The decryption process is completed by 
reducing (7.2.12) modulo p, to obtain 


H*(f)m + H*(g)r = ml, (mod p). 
Thus one gets plaintext m from ciphertext c. We finish the procedure of our 


general NTRU cryptography. 


At the end of this section, we give an example to show the correctness of decryption 
of general NTRU cryptography. 


Example 7.2 Letn = 3, p = 3,4 = 7, p(x) = x? +x? +x + 1, f(x) = 3x? +1, 


g(x) = 3x?, i.e. the private key is H with 
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It is easy to get 
1-33 
H*(f)= (0-20 
3-31 


0—33 
H*(g) = | 0—30 
3-30 


By (7.2.9), we compute h and H*(h) as follows 


2 
h= (H*(f)'g (modq)= | 0 |, 
—3 
23-3 
H*(h)=] 05 0 |, 
—33 2 


then the public key N is 
_ (b H*(h) 
v= (on): 


Assume the input message and random vector are 


1 0 
m={0],r=]1], 
0 0 
we get the ciphertext by (7.2.11) 
=3 


c =m + H*(h)r = | —2 | (mod 7). 
3 


From (7.2.12) we have 
—2 
H*(f)c = | —3 | (mod 7). 
0 
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Since 
—2 1 
—3 | = |0] (mod3), 
0 0 


one can get the plaintext m from ciphertext c, 
1 
m= |0 
0 


So we verify the correctness and effectiveness of the general NTRU cryptography. 
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